CVE-2026-16437

Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, MC Works64 all versions, GENESIS32 all versions, BizViz all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, GENESIS32 all versions, and BizViz all versions allows an authenticated local user with administrative privileges to unlock the system by tampering with the management file that stores the challenge response. Administrators are able to read and write the management file. But the management file is protected by Windows. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.

• CWE-640

• https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf

Published

Oct 15, 2026

Last Modified

Oct 16, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-16428IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage co…8.8
• CVE-2026-1643The MP-Ukagaka plugin for WordPress is vulnerable to Reflect…6.1
• CVE-2026-16432IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage Px…6.5
• CVE-2026-16434Adminer 4.6.0 through 5.5.0 (fixed in 5.5.1) contains an inc…2.3
• CVE-2026-16435IBM WebSphere Application Server 9.0, and 8.5 is affected by…5.9
• CVE-2026-16436Weak Password Recovery Mechanism for Forgotten Password vuln…9.2
• CVE-2026-16438Incorrect Privilege Assignment vulnerability in Mitsubishi E…9.4
• CVE-2026-16439In Eclipse OpenJ9 versions up to 0.60, using -Xtrace to trac…9.1
• CVE-2026-1644The WP Frontend Profile plugin for WordPress is vulnerable t…4.3
• CVE-2026-16440In Eclipse OpenJ9 versions up to 0.60, a crafted .class file…5.7
• CVE-2026-16441In Eclipse OpenJ9 versions up to 0.60, when executing class …9.6
• CVE-2026-16442A flaw was found in the SAML broker component of Keycloak, w…9.8