{"metadata": {"vulnerability": "CVE-2026-16438", "count": 18, "kinds": {"milestone": 4, "sighting": 6, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-07-21T04:30:33.100Z", "date_only": false, "value": "2026-07-21T04:30:33.100Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-16438", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-15T08:31:41.267Z", "date_only": false, "value": "2026-10-15T08:31:41.267Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-16438", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-15T08:50:09.084Z", "date_only": false, "value": "2026-10-15T08:50:09.084725Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117444064608709950", "record": "CVE-2026-16438", "field": "creation_timestamp", "uuid": "66118b03-4290-43bd-99e9-ec64d511484b", "content": "CVE-2026-16438 An arbitrary operation vulnerability in GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, and MC Works64 Incorrect Privilege Assignment vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, MC Works64 all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, and MobileHMI 10.97.3 and prior allows an attacker who can log in using the same administrator account for the affected products to launch and operate DCOM objects locally or remotely. During installation, the installers of the affected products unnecessarily grant default DCOM permissions to the administrator account of the affected products. Users with that administrator accounts can locally or remotely launch and operate DCOM objects that should require UAC elevation. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.\nhttps://www.cve.org/CVERecord?id=CVE-2026-16438https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdfhttps://jvn.jp/vu/JVNVU#93251594/#MitsubishiElectricCorporation #GENESIS64 #MitsubishiElectricIconicsDigitalSolutions #ICONICSSuite #HyperHistorian #AnalytiX #MobileHMI #MCWorks64#CVE_2026_16438#bot", "url": "https://infosec.exchange/users/cve/statuses/117444064608709950"}, {"timestamp": "2026-10-15T09:00:31.348Z", "date_only": false, "value": "2026-10-15T09:00:31.348457Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117444105377164682", "record": "cve-2026-16438", "field": "creation_timestamp", "uuid": "d16be2b9-9ab3-434b-8dcd-d7bef8dab150", "content": "CVE-2026-16438 (CRITICAL, CVSS 9.4): Incorrect privilege assignment in Mitsubishi GENESIS64 & related products. Admin users can launch DCOM objects, risking DoS & data loss. Restrict admin access & monitor usage. https://radar.offseq.com/threat/cve-2026-16438-cwe-266-incorrect-privilege-assignment-in-mitsubishi-electric-corporation-genesis64-980e045a57b35746 #OffSeq #ICS #Vulnerability", "url": "https://infosec.exchange/users/offseq/statuses/117444105377164682"}, {"timestamp": "2026-10-15T09:00:33.453Z", "date_only": false, "value": "2026-10-15T09:00:33.453917Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mxvp5uvymj2y", "record": "cve-2026-16438", "field": "creation_timestamp", "uuid": "d2a0c59f-ae49-4914-a726-0a8a489f17eb", "content": "CRITICAL severity: Mitsubishi GENESIS64 vuln (CVE-2026-16438) lets admin users launch DCOM objects and cause DoS or data loss. Audit admin accounts & restrict DCOM now. https://radar.offseq.com/threat/cve-2026-16438-cwe-266-incorrect-privilege-assignment-in-mitsubishi-electric-corporation-genesis...", "url": "https://bsky.app/profile/offseq.bsky.social/post/3mxvp5uvymj2y"}, {"timestamp": "2026-10-15T09:17:17Z", "date_only": false, "value": "2026-10-15T09:17:17Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-QCW9-8PCC-76G9", "record": "GHSA-QCW9-8PCC-76G9", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-15T09:17:17.087Z", "date_only": false, "value": "2026-10-15T09:17:17.087", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-16438", "record": "FKIE_CVE-2026-16438", "field": "published"}, {"timestamp": "2026-10-15T09:30:35Z", "date_only": false, "value": "2026-10-15T09:30:35Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-QCW9-8PCC-76G9", "record": "GHSA-QCW9-8PCC-76G9", "field": "published"}, {"timestamp": "2026-10-15T09:30:35Z", "date_only": false, "value": "2026-10-15T09:30:35Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-QCW9-8PCC-76G9", "record": "GHSA-QCW9-8PCC-76G9", "field": "modified"}, {"timestamp": "2026-10-15T09:40:05.072Z", "date_only": false, "value": "2026-10-15T09:40:05.072990Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxvreli2j52h", "record": "CVE-2026-16438", "field": "creation_timestamp", "uuid": "cbb6a7d3-1bc5-44b4-8d18-11c272cc214b", "content": "CVE-2026-16438 - genesis64\nVersions of GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, and MC Works64 grant their administrator accounts permission to start system components without required\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#genesis64 #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxvreli2j52h"}, {"timestamp": "2026-10-15T10:07:46.276Z", "date_only": false, "value": "2026-10-15T10:07:46.276482Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxvsw3otxj22", "record": "CVE-2026-16438", "field": "creation_timestamp", "uuid": "306bec8c-5ef9-4270-864c-cddd1b1fc842", "content": "\ud83d\udea8 CVE-2026-16438 \u2014 CVSS 9.4 CRITICAL\n\nIncorrect Privilege Assignment vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, I...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-16438\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mxvsw3otxj22"}, {"timestamp": "2026-10-15T14:04:50.609Z", "date_only": false, "value": "2026-10-15T14:04:50.609085Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-16438", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-15T14:04:50.609Z", "date_only": false, "value": "2026-10-15T14:04:50.609085Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-16438", "record": "FKIE_CVE-2026-16438", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-15T14:07:48.535Z", "date_only": false, "value": "2026-10-15T14:07:48.535Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-16438", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T01:26:04.270Z", "date_only": false, "value": "2026-10-16T01:26:04.270860Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mxxga3xa642w", "record": "CVE-2026-16438", "field": "creation_timestamp", "uuid": "be6c63ef-8d02-4952-801e-8caa0729b9f6", "content": "Review the Mitsubishi Electric security advisory fixing critical ICONICS Suite vulnerabilities, including CVE-2026-16438 and CVE-2026-16436.\n\n#MitsubishiElectric #ICONICS #GENESIS64 #ICS #OTSecurity #Cybersecurity #Vulnerability #InfoSec", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mxxga3xa642w"}, {"timestamp": "2026-10-16T05:41:46.956Z", "date_only": false, "value": "2026-10-16T05:41:46.956Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-16438", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-16T05:41:46.956Z", "date_only": false, "value": "2026-10-16T05:41:46.956Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Mitsubishi", "record": "CVE-2026-16438", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T06:17:11.153Z", "date_only": false, "value": "2026-10-16T06:17:11.153", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-16438", "record": "FKIE_CVE-2026-16438", "field": "lastModified"}]}