CVE-2026-16436

Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, MC Works64 all versions, GENESIS32 all versions, BizViz all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, GENESIS32 all versions, and BizViz all versions allows a remote attacker to unlock the system by obtaining the challenge response by some means. The challenge response used to unlock the system is common to all users and fixed. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.

• CWE-640

• https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf

Published

Oct 15, 2026

Last Modified

Oct 16, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-16426IBM Concert 1.0.0 through 3.0.0 is vulnerable to server-side…6.5
• CVE-2026-16428IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage co…8.8
• CVE-2026-1643The MP-Ukagaka plugin for WordPress is vulnerable to Reflect…6.1
• CVE-2026-16432IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage Px…6.5
• CVE-2026-16434Adminer 4.6.0 through 5.5.0 (fixed in 5.5.1) contains an inc…2.3
• CVE-2026-16435IBM WebSphere Application Server 9.0, and 8.5 is affected by…5.9
• CVE-2026-16437Weak Password Recovery Mechanism for Forgotten Password vuln…7.1
• CVE-2026-16438Incorrect Privilege Assignment vulnerability in Mitsubishi E…9.4
• CVE-2026-16439In Eclipse OpenJ9 versions up to 0.60, using -Xtrace to trac…9.1
• CVE-2026-1644The WP Frontend Profile plugin for WordPress is vulnerable t…4.3
• CVE-2026-16440In Eclipse OpenJ9 versions up to 0.60, a crafted .class file…5.7
• CVE-2026-16441In Eclipse OpenJ9 versions up to 0.60, when executing class …9.6