CVE-2026-16438

{
  "etk_id": "ETK-2026-1659",
  "cve_id": "CVE-2026-16438",
  "display_id": "CVE-2026-16438",
  "ghsa_id": "GHSA-qcw9-8pcc-76g9",
  "euvd_id": "EUVD-2026-101942",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Incorrect DCOM privilege assignment in GENESIS64",
  "summary": "GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI through 10.97.3, plus all MC Works64 versions, assign excessive default DCOM permissions. An attacker who can authenticate with the affected product administrator account may operate DCOM objects without the expected UAC elevation, potentially exposing or altering data or disrupting the system.",
  "mitigation": "Restrict and monitor use of affected product administrator accounts, and limit DCOM access to trusted local users and hosts. Review installed products' DCOM permissions and remove unnecessary rights; no fixed version is recorded in the advisory.",
  "vendor": "Mitsubishi Electric Corporation",
  "product": "GENESIS64",
  "affected": [
    {
      "affected_notes": [
        "versions 10.97.3 and prior"
      ],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "GENESIS64",
      "purl": null
    },
    {
      "affected_notes": [
        "versions 10.97.3 and prior"
      ],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "ICONICS Suite",
      "purl": null
    },
    {
      "affected_notes": [
        "versions 10.97.3 and prior"
      ],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Hyper Historian",
      "purl": null
    },
    {
      "affected_notes": [
        "versions 10.97.3 and prior"
      ],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "AnalytiX",
      "purl": null
    },
    {
      "affected_notes": [
        "versions 10.97.3 and prior"
      ],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "MobileHMI",
      "purl": null
    },
    {
      "affected_notes": [
        "all versions"
      ],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "MC Works64",
      "purl": null
    }
  ],
  "cwes": [
    266
  ],
  "cvss_score": 9.4,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
  "epss_score": 0.0023,
  "epss_percentile": 0.1287,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 12.38418355,
  "t0_at": "2026-10-15T08:31:41.267000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-15T08:31:41.267000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-15T08:31:41.267000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16438"
    }
  }
}