— Unscored

Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz

CVE-2023-4863

View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code (CVE-2023-4863), bypass authentication (CVE-2026-16436 and CVE-2026-16437), or perform arbitrary operations (CVE-2026-16438), resulting in information disclosure, tampering with, destruction, or deletion of information, and a denial-of-service (DoS) condition of the system. The following versions of Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, HyperHistorian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32, BizViz, Mitsubishi Electric Iconics Digital Solutions GENESIS, GENESIS64, ICONICS Suite, HyperHistorian, AnalytiX, MobileHMI, IoTWorX, GENESIS32 and BizViz are affected: Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions GENESIS64 >=10.97|<=10.97.2 (CVE-2023-4863) Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions ICONICS Suite >=10.97|<=10.97.2 (CVE-2023-4863) Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions GENESIS <=11.03 (CVE-2026-16436, CVE-2026-16437) Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions GENESIS64 <=10.97.3 (CVE-2026-16436,…

Proof-of-concept code is published

Public PoC

Public PoCmistymntncop/CVE-2023-4863320 stars
Public PoCLiveOverflow/webp-CVE-2023-486356 stars
Public PoCcaoweiquan322/NotEnough25 stars
Public PoCmurphysecurity/libwebp-checker21 stars
Public PoCbbaranoff/CVE-2023-48636 stars
Public PoCGTGalaxi/ElectronVulnerableVersion6 stars
Public PoCOITApps/Find-VulnerableElectronVersion5 stars
Public PoChuiwen-yayaya/CVE-2023-48634 stars

Signals come from Exploit-DB, Metasploit, Nuclei and published proof-of-concept repositories. Their absence means nothing was found, not that nothing exists.

Assessment

CVSS: Not yet scored
Severity: Unscored
Known exploited: Not listed in CISA KEV
Exploit availability: Public PoC
Published: 27 October 2026
Last updated: 27 October 2026

At the source

CISA Advisories

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-300-02

Community proofs of concept

No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.

Submit a proof of concept

Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.

Title *

Proof of concept *

Write-up (optional)

Affected versions (optional)

Name or handle (optional)

References (optional, one URL per line)

Licence for your contribution *

Private contact (optional, never shown)

Before you submit * This vulnerability is already publicly disclosed (it has a published CVE). This material comes only from testing I was authorised to perform. I have the legal right to publish this content and am not breaching any agreement by doing so. It contains no live credentials, personal data, or anything targeting systems I am not authorised to test. I understand it will be reviewed before it appears publicly and may be rejected. I agree to the submission terms.

What is 6 + 2? *

Query this programmatically

Agents can read this through the MCP endpoint, or over HTTP:

curl https://cve.zerocrew.in/api/cve/CVE-2023-4863