[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fJQFvgkgEFq7ChzMgVPae7koP1smFvUAT1jJzxarc-sI":3},{"article":4,"iocs":43,"watch_terms":48,"solutions":49,"lesson":138},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":30},"045982bd-c2e3-4da1-aedc-9836ef132bc7","Siemens Mendix SAML Module","siemens-mendix-saml-module-c0138f","View CSAF Summary Mendix SAML module contains an authentication bypass vulnerability that could allow an unauthenticated remote attacker to gain unauthorized access by replaying a valid SAML assertion in IdP-initiated authentication flows. Siemens has released new versions for the affected products and recommends to update to the latest versions. The following versions of Siemens Mendix SAML Module are affected: Mendix SAML (Mendix 10 compatible) vers:intdot\u002F\u003C4.2.4 (CVE-2026-89209) Mendix SAML (Mendix 11 compatible) vers:intdot\u002F\u003C4.2.4 (CVE-2026-89209) Mendix SAML (Mendix 9 compatible) vers:intdot\u002F\u003C3.6.29 (CVE-2026-89209) CVSS Vendor Equipment v3 6.8 Siemens Mendix SAML (Mendix 10 compatible) 1 Vulnerability Authentication Bypass by Capture-replay Background Critical Infrastructure Sectors: Critical Manufacturing, Information Technology Countries\u002FAreas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities CVE-2026-89209 Affected versions of the module do not properly protect against SAML assertion replay in IdP-initiated authentication flows. This could allow unauthenticated remote attackers to gain unauthorized access to the application by replaying a valid SAML response. Read More 3 Affected Products Mendix SAML (Mendix 10 compatible) \u003C V4.2.4 Product Status: known_affected Remediations Mitigation Disable IdP-initiated SSO Vendor fix Update to V4.2.4 or later version Mendix SAML (Mendix 11 compatible) \u003C V4.2.4 Product Status: known_affected Remediations Mitigation Disable IdP-initiated SSO Vendor fix Update to V4.2.4 or later version Mendix SAML (Mendix 9 compatible) \u003C V3.6.29 Product Status: known_affected Remediations Mitigation Disable IdP-initiated SSO Vendor fix Update to V3.6.29 or later version Additional Metrics Relevant CWE: CWE-294 Authentication Bypass by Capture-replay CVSS Version Base Score Base Severity Vector String 3.1 6.8 MEDIUM CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:N View CVE Details Acknowledgments Siemens ProductCERT reported this vulnerability to CISA. General Recommendations As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https:\u002F\u002Fwww.siemens.com\u002Fcert\u002Foperational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https:\u002F\u002Fwww.siemens.com\u002Findustrialsecurity Additional Resources For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https:\u002F\u002Fwww.siemens.com\u002Fcert\u002Fadvisories Terms of Use The use of Siemens Security Advisories is subject to the terms and conditions listed on: https:\u002F\u002Fwww.siemens.com\u002Fproductcert\u002Fterms-of-use. Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all control system devices and\u002For systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov\u002Fics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov\u002Fics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. Advisory Conversion Disclaimer This ICSA is a verbatim republication of Siemens ProductCERT SSA-137528 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory. Revision History Initial Release Date: 2026-10-26 Date Revision Summary 2026-10-26 1 Publication Date 2026-10-29 2 Initial CISA Republication of Siemens ProductCERT SSA-137528 advisory Legal Notice and Terms of Use","A critical authentication bypass vulnerability (CVE-2026-89209) has been discovered in Siemens' Mendix SAML module. The flaw allows unauthenticated remote attackers to gain unauthorized access by replaying a valid SAML assertion in IdP-initiated authentication flows. Siemens has released updated versions of the affected Mendix SAML modules and recommends immediate patching.","Siemens Mendix SAML module vulnerable to authentication bypass via SAML assertion replay.","https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fics-advisories\u002Ficsa-26-302-01",null,"2026-10-29T12:00:00+00:00","2026-10-29T15:00:11.761616+00:00",8,[17,20,23],{"name":18,"type":19},"Mendix SAML","product",{"name":21,"type":22},"Siemens","vendor",{"name":24,"type":25},"SAML","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":26,"icon":12,"name":28,"slug":29},"Vulnerabilities","vulnerabilities",[31,36,38],{"category":32},{"id":33,"icon":12,"name":34,"slug":35},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":37},{"id":26,"icon":12,"name":28,"slug":29},{"category":39},{"id":40,"icon":12,"name":41,"slug":42},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",[44],{"type":45,"value":46,"context":47},"cve","CVE-2026-89209","Authentication bypass vulnerability in Siemens Mendix SAML module",[21,18],{"controls":50,"vendors":132},[51,80,106],{"slug":52,"name":53,"problem":54,"products":55},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[56,64,72],{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":60,"product_name":61,"url":62,"description":63},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"slug":81,"name":82,"problem":83,"products":84},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[85,93,98],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":94,"product_name":95,"url":96,"description":97},"defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":107,"name":108,"problem":109,"products":110},"patch-management","Automated patch management","Known holes get closed in days, not months.",[111,116,124],{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":112,"product_name":113,"url":114,"description":115},"intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",[133],{"slug":134,"name":21,"logo_path":135,"roles":136},"siemens","\u002Fvendor-logos\u002Fsiemens.png",[137],"affected",{"slug":139,"title":140,"body":141,"framework_refs":142,"framework_notes":150},"siemens-mendix-saml-auth-bypass-highlights-critical-patch-urgency","Siemens Mendix SAML Auth Bypass Highlights Critical Patch Urgency","A critical authentication bypass flaw in the Siemens Mendix SAML module allows unauthenticated attackers to replay valid SAML assertions and gain unauthorized access without credentials, effectively undermining the entire authentication layer. The root cause lies in insufficient validation of SAML assertions during IdP-initiated flows, a well-understood class of vulnerability that should be caught during both development and routine security review. This matters because SAML is a foundational identity federation protocol — bypassing it can grant attackers the same access level as legitimate users, including administrators. Siemens has released patches, making delayed adoption the primary remaining risk for affected organizations.",[143,144,145,146,147,148,149],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":151,"PCI DSS Requirement 6":152,"NIST SP 800-53 SI-2: Flaw Remediation":153,"OWASP A06:2021 Vulnerable and Outdated Components":154,"CIS Control 7: Continuous Vulnerability Management":155,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":156,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":157},"NIS2 requires essential and important entities to implement appropriate measures for incident handling and vulnerability management, obligating affected organizations to treat this critical authentication bypass as a priority remediation item.","Requirement 6 mandates that organizations develop and maintain secure systems by applying security patches in a timely manner, which would require immediate deployment of Siemens' fix for this critical authentication vulnerability in any cardholder data environment using Mendix.","SI-2 requires organizations to identify, report, and correct information system flaws — a formal flaw remediation process would have ensured the Mendix SAML patch was applied within an organizationally defined timeframe.","The unpatched Mendix SAML module is a textbook example of a vulnerable component; OWASP A06 guidance to track, monitor, and promptly update third-party components would have directly prevented this exposure.","Regular, automated vulnerability scanning and a defined remediation timeline would have flagged this critical SAML flaw immediately upon Siemens' advisory, enabling rapid patching before exploitation.","This Annex A control mandates timely identification and remediation of technical vulnerabilities in deployed software, which would have driven prompt patching of the Mendix SAML module upon vendor disclosure.","This control directly addresses the integrity of authentication mechanisms; validating that SAML assertion replay protections are in place falls squarely within its scope and would have mitigated this bypass."]