Mitsubishi GENESIS64 DCOM Flaw Grants Local Admin Remote Execution Rights
A critical privilege assignment error in Mitsubishi Electric GENESIS64 allows attackers with admin access to launch remote DCOM objects without elevation.
Key points
- CVE-2026-16438 affects GENESIS64 versions 10.97.3 and earlier.
- The flaw allows remote launch of DCOM objects that require UAC elevation.
- Attackers can cause denial-of-service or tamper with internal system data.
An attacker who secures an administrator account on Mitsubishi Electric GENESIS64 systems can launch and operate Distributed Component Object Model objects remotely or locally, bypassing standard User Account Control elevation requirements. This capability, driven by incorrect privilege assignments during installation, allows the adversary to disclose, tamper with, or destroy internal information. According to the National Vulnerability Database, the flaw also enables the attacker to force the affected system into a denial-of-service condition.
How it unfolded
- Installers for affected products grant default DCOM permissions to the administrator account.
- These permissions allow the account to launch objects that normally require elevation.
- An attacker using the administrator account exploits these permissions to operate DCOM objects.
Who is affected
The vulnerability impacts Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, along with Mitsubishi Electric Iconics Digital Solutions GENESIS64 of the same version range. ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI versions 10.97.3 and prior are also affected. Additionally, all versions of MC Works64 are listed as vulnerable in the National Vulnerability Database record for this issue.
The fix
No patch or update has been confirmed yet by the vendor. The National Vulnerability Database rates CVE-2026-16438 as critical with a CVSS score of 9.4. Users should monitor official channels for Mitsubishi Electric for any security advisories or version updates that address the incorrect privilege assignment in the installation process.
What made it possible
Teams usually encounter this class of issue when installers grant excessive privileges to service accounts. The weakness stems from default configurations that fail to restrict remote execution rights. This serves the lateral movement stage of an intrusion, allowing an attacker to expand their reach within the network. Check whether service accounts have unnecessary DCOM permissions. Verify that installation scripts do not grant administrative privileges to non-privileged users. Ensure that remote object launches require proper authentication and elevation.
What to do and how to stay safe: Mitsubishi Electric
- Audit administrator accounts for unnecessary DCOM launch permissions on affected systems.
- Restrict remote access to GENESIS64 and related ICONICS products to trusted networks.
- Monitor logs for unauthorized DCOM object launches or unexpected service interruptions.
- Isolate affected systems until a vendor-provided update addresses the privilege flaw.
Step-by-step guide: What Is Virtual Patching: How It Works Without Code Changes
General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific products are affected by CVE-2026-16438?
GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, and MC Works64 are affected.
What is the severity rating for this vulnerability?
The National Vulnerability Database rates it as critical with a CVSS score of 9.4.
Does this flaw allow remote code execution without authentication?
No, the attacker must log in using the same administrator account for the affected products.
