Mitsubishi Electric's Oct 15 advisory covers multiple bugs across GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz. For CVE-2026-16438 (CWE-266, CVSS 9.4), the installers grant default DCOM permissions to the products' administrator account, so anyone logged in with that account can launch and operate DCOM objects locally or remotely without UAC elevation, which can lead to data disclosure, tampering or denial of service. It needs that admin account. Fixed in ICONICS Suite 10.98 or later; MC Works64 won't be fixed, and Mitsubishi says to migrate to GENESIS64 or GENESIS.