On October 29, 2026, CISA last revised ICSA-26-300-02, an advisory covering a wide family of Mitsubishi Electric and Iconics Digital Solutions SCADA/HMI products: GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz. CISA lists the deployment as worldwide and the affected sector as Critical Manufacturing — the same product family plants use to render operator dashboards, historize process data and push HMI screens to engineers' phones and tablets on the shop floor.
A 2023 Image Bug Resurfaces at Critical Severity
The highest-rated entry, CVE-2023-4863, is an out-of-bounds write in the libwebp image library — the same flaw that was exploited in the wild against browsers and messaging apps back in 2023. CISA now scores its impact inside GENESIS64 and ICONICS Suite versions 10.97 through 10.97.2 at 8.2 High on CVSS v3.1 and 9.3 Critical on CVSS v4.0, since a crafted image imported into the HMI configuration can trigger arbitrary code execution on the engineering workstation. It is a reminder that a bundled third-party library doesn't stop being a liability just because the headline CVE is two years old — it keeps scoring against every product that never bumped the dependency.
ICSA-26-300-02 — Key Facts
- CVE-2023-4863 — libwebp out-of-bounds write in GENESIS64/ICONICS Suite 10.97–10.97.2, CVSS v4.0 9.3, enables arbitrary code execution via a crafted image import;
- CVE-2026-16436 & CVE-2026-16437 — weak password-recovery flaws across 23 affected product/version combinations, each CVSS v4.0 9.2, the unlock challenge-response is fixed and common to every installation;
- Products in scope — GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32, BizViz;
- Fixes — ICONICS Suite 10.97.3 (libwebp), 10.98 for the 2026-dated components and IoTWorX, GENESIS 11.04 or later;
- No fix planned — MC Works64, GENESIS32 and BizViz; Mitsubishi recommends migrating to a supported release instead.
The Mobile Client Is Explicitly in Scope
MobileHMI's inclusion matters beyond the product list: it is the component that lets a shift supervisor acknowledge an alarm or check a trend chart from a handheld device instead of walking back to a fixed console. A weak, fixed password-recovery challenge in that chain means an attacker who can reach the mobile client's recovery flow inherits the same account-unlock path on every deployment — there is no per-site variation to brute-force around. For plants that built or extended their own mobile HMI layer on top of a vendor SDK rather than running the stock client, the practical question isn't just "did we patch GENESIS" but "did our own mobile app inherit this unlock logic, and does it need a custom fix the vendor update won't touch."
Patching the Suite Doesn't Patch What Was Built on Top of It
Bumping ICONICS Suite to 10.98 or GENESIS to 11.04 addresses the vendor-shipped binaries. It does nothing for a plant's own mobile companion app, custom alarm-acknowledgment screen, or integration layer that calls into the same authentication APIs — those need their own audit and, where the weak recovery logic was copied rather than inherited, their own fix. YuSMP Group's mobile development team builds and hardens exactly this kind of field-facing HMI and alarm-acknowledgment app, and can review a site's custom mobile layer for the same weak-recovery pattern CISA flagged in MobileHMI before rolling the vendor patch into production.
Sources: CISA ICS Advisory ICSA-26-300-02, last revised October 29, 2026; Industrial Cyber, CISA ICS advisory roundup.