What happened
CISA’s advisory (ICS‑A‑26‑300‑02) reports four CVEs affecting a broad set of Mitsubishi Electric industrial‑control applications. CVE‑2023‑4863 provides remote arbitrary‑code execution. CVE‑2026‑16436 and CVE‑2026‑16437 bypass authentication, granting unauthenticated access to system functions. CVE‑2026‑16438 enables arbitrary operations that can lead to data disclosure, tampering, deletion, or denial‑of‑service. Affected versions span GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz. No patches are publicly available yet; mitigation guidance recommends immediate version verification, network segmentation, and preparation for rapid patch deployment.
Why it matters for trust and compliance
- These flaws test the access‑control control objective, a core element of NIST CSF 2.0 Protect. Demonstrating strong identity management and continuous monitoring of privileged access helps maintain audit‑ready evidence despite such vulnerabilities.
- Provides concrete evidence for access‑control monitoring and audit trails across frameworks.
- Highlights the need for continuous third‑party software inventory and patch‑management evidence.
Who is affected
MANUF_IND ENERGY_UTIL
Recommended actions
- Identify and inventory all affected Mitsubishi Electric products in your environment.
- Apply vendor patches or upgrade to a non‑vulnerable version as soon as they are released.
- Temporarily segment or isolate vulnerable systems from external networks.
- Run targeted vulnerability scans to confirm remediation.
- Review and tighten access‑control policies, enforcing MFA for remote access.
- Update incident‑response playbooks to include detection of unauthorized command execution on these platforms.
Details
- CVEs
- CVE-2023-4863, CVE-2026-16436, CVE-2026-16437, CVE-2026-16438