CVE-2026-16438

Incorrect Privilege Assignment vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, MC Works64 all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, and MobileHMI 10.97.3 and prior allows an attacker who can log in using the same administrator account for the affected products to launch and operate DCOM objects locally or remotely. During installation, the installers of the affected products unnecessarily grant default DCOM permissions to the administrator account of the affected products. Users with that administrator accounts can locally or remotely launch and operate DCOM objects that should require UAC elevation. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.

• CWE-266

• https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf

Published

Oct 15, 2026

Last Modified

Oct 16, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-1643The MP-Ukagaka plugin for WordPress is vulnerable to Reflect…6.1
• CVE-2026-16432IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage Px…6.5
• CVE-2026-16434Adminer 4.6.0 through 5.5.0 (fixed in 5.5.1) contains an inc…2.3
• CVE-2026-16435IBM WebSphere Application Server 9.0, and 8.5 is affected by…5.9
• CVE-2026-16436Weak Password Recovery Mechanism for Forgotten Password vuln…9.2
• CVE-2026-16437Weak Password Recovery Mechanism for Forgotten Password vuln…7.1
• CVE-2026-16439In Eclipse OpenJ9 versions up to 0.60, using -Xtrace to trac…9.1
• CVE-2026-1644The WP Frontend Profile plugin for WordPress is vulnerable t…4.3
• CVE-2026-16440In Eclipse OpenJ9 versions up to 0.60, a crafted .class file…5.7
• CVE-2026-16441In Eclipse OpenJ9 versions up to 0.60, when executing class …9.6
• CVE-2026-16442A flaw was found in the SAML broker component of Keycloak, w…9.8
• CVE-2026-16443A flaw was found in the SAML metadata import functionality o…9.1