Answer Brief
Siemens has addressed an authentication bypass vulnerability, tracked as CVE-2026-89209, in its Mendix SAML module. The flaw allows an unauthenticated remote attacker to gain unauthorized access by replaying a valid SAML assertion in IdP-initiated authentication flows. Siemens and CISA advise updating affected versions or applying mitigations across Critical Manufacturing and Information Technology environments deployed worldwide.
Signal Timeline
A quick visual path for analysts before reading the full brief.
- 1
Siemens ProductCERT publishes security advisory SSA-137528.
- 2
CISA republishes the Siemens advisory as ICS advisory ICSA-26-302-01.
Executive Summary: Siemens has addressed an authentication bypass vulnerability, tracked as CVE-2026-89209, in its Mendix SAML module. The flaw allows an unauthenticated remote attacker to gain unauthorized access by replaying a valid SAML assertion in IdP-initiated authentication flows. Siemens and CISA advise updating affected versions or applying mitigations across Critical Manufacturing and Information Technology environments deployed worldwide.
Why It Matters
On October 29, 2026, the Cybersecurity and Infrastructure Security Agency republished an industrial control systems advisory, alert code ICSA-26-302-01, detailing an authentication bypass vulnerability in the Siemens Mendix SAML module. The publication represents a direct conversion of Siemens ProductCERT advisory SSA-137528, which had an initial release date of October 26, 2026. The advisory provides remediation and mitigation guidance for organizations deploying affected components globally.
The vulnerability is tracked as CVE-2026-89209 and corresponds to Common Weakness Enumeration CWE-294: Authentication Bypass by Capture-replay. CVE-2026-89209 has a CVSS v3.1 base score of 6.8 (MEDIUM), with a vector string of CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N. The metric reflects network-accessible vulnerability characteristics combined with high access complexity and required user interaction.
Technical Signal
According to the advisory details, affected versions of the module do not properly protect against SAML assertion replay in identity provider (IdP)-initiated authentication flows. When such flows are implemented without replay protection, the underlying authentication verification mechanism fails to invalidate or reject previously presented assertion data.
The operational impact of this weakness allows an unauthenticated remote attacker to gain unauthorized access to the application by replaying a valid SAML response. Because the attack leverages a valid SAML assertion captured from legitimate sessions, the system processes the replayed response as an authenticated entry without requiring the attacker to possess prior system credentials.
Operational Impact
The scope of impact spans three distinct compatibility streams of the module. Specifically, Mendix SAML (Mendix 10 compatible) versions prior to V4.2.4, Mendix SAML (Mendix 11 compatible) versions prior to V4.2.4, and Mendix SAML (Mendix 9 compatible) versions prior to V3.6.29 are designated as known affected products under the advisory.
Siemens has released new versions for the affected software lines and recommends that operators update to the latest releases. For environments utilizing Mendix SAML compatible with Mendix 10 or Mendix 11, the vendor fix requires updating to V4.2.4 or later. For environments operating Mendix SAML compatible with Mendix 9, the fix requires updating to V3.6.29 or later. In cases where immediate updating is not feasible, Siemens provides a specific mitigation: operators can disable IdP-initiated single sign-on (SSO).
What To Watch
In addition to the software updates and specific SSO mitigation, Siemens strongly recommends general security measures to protect network access to devices with appropriate mechanisms. The vendor advises operating equipment within a protected IT environment configured according to Siemens operational guidelines for Industrial Security and following the standard instructions published in product manuals.
CISA recommends that defensive measures be applied to minimize exploitation risks, including ensuring control system devices are not accessible from the internet and isolating control system networks and remote devices behind firewalls away from business networks. CISA also advises conducting proper impact analysis and risk assessment prior to deploying defensive controls, using updated VPN configurations for necessary remote connections, and reporting suspected malicious activity through established internal procedures.
Event Type: security
Importance: medium
Affected Companies
- Siemens
Affected Sectors
- Critical Manufacturing
- Information Technology
Key Numbers
- Vulnerability: 1
- Affected Products: 3
- Base Score: 6.8
Timeline
- Siemens ProductCERT publishes security advisory SSA-137528.
- CISA republishes the Siemens advisory as ICS advisory ICSA-26-302-01.
Frequently Asked Questions
What vulnerability affects the Siemens Mendix SAML module?
The module contains CVE-2026-89209, categorized under CWE-294 as Authentication Bypass by Capture-replay. It lacks proper protection against SAML assertion replay in IdP-initiated authentication flows, which could allow an unauthenticated remote attacker to gain unauthorized access by replaying a valid SAML assertion or response. CVE-2026-89209 has a CVSS v3.1 base score of 6.8 (MEDIUM).
Which specific versions of the Mendix SAML module are affected?
The advisory lists three affected product streams: Mendix SAML (Mendix 10 compatible) versions prior to V4.2.4, Mendix SAML (Mendix 11 compatible) versions prior to V4.2.4, and Mendix SAML (Mendix 9 compatible) versions prior to V3.6.29. All three versions are listed with known affected product status.
What remediation and mitigation steps has Siemens provided?
Siemens released vendor fixes requiring updates to V4.2.4 or later for Mendix 10 and Mendix 11 compatible versions, and V3.6.29 or later for Mendix 9 compatible versions. As a mitigation measure, organizations can disable IdP-initiated SSO. Siemens also recommends configuring the environment according to its operational guidelines for Industrial Security.
What sectors and deployment regions are identified in the advisory?
The advisory states that affected products are deployed worldwide across the Critical Manufacturing and Information Technology sectors. The vendor, Siemens, is headquartered in Germany. The advisory was reported to CISA by Siemens ProductCERT and converted directly from the vendor's Common Security Advisory Framework advisory.