Advisories › Siemens › ICSA-26-209-02
Siemens Mendix Runtime: 1 CVE, Unknown
Summary
CISA reports 1 vulnerability in Siemens Mendix Runtime. Weakness type: Insecure Inherited Permissions. This advisory is revoked. Re-investigation confirmed the reported behavior is expected platform configuration and does not expose the protected attribute.
What to do: Plan: Review the vendor guidance linked in the source advisory and apply CISA's recommended practices.
At a glance
- Vendor
- Siemens
- Products
- Mendix Runtime
- CVEs
- CVE-2026-7891
- Highest CVSS v3
- –
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Critical Manufacturing
- Deployed
- Worldwide
- Vendor HQ
- Germany
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-7891 | Insecure Inherited Permissions | – | – | No | CVE-2026-7891 |
Affected products (1)
- Mendix Runtime
Vendor fixes and mitigations (from advisory)
- None listed in the advisory.
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
- CISA advisory ICSA-26-209-02
- Machine-readable CSAF record
- https://cert-portal.siemens.com/productcert/csaf/ssa-814963.json
- https://cert-portal.siemens.com/productcert/html/ssa-814963.html
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.