Siemens Mendix Studio Pro
View CSAF Summary Mendix Studio Pro versions before V11.12 are affected by a file parsing vulnerability that could be triggered when the application reads specially crafted malicious project during the build pipeline. This could allow an attacker to execute arbitrary code in the context of that user. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available. The following versions of Siemens Mendix Studio Pro are affected: Mendix Studio Pro 10.11 vers:all/* Mendix Studio Pro 10.12 vers:all/* Mendix Studio Pro 10.13 vers:all/* Mendix Studio Pro 10.14 vers:all/* Mendix Studio Pro 10.15 vers:all/* Mendix Studio Pro 10.16 vers:all/* Mendix Studio Pro 10.17 vers:all/* Mendix Studio Pro 10.18 vers:all/* Mendix Studio Pro 10.19 vers:all/* Mendix Studio Pro 10.20 vers:all/* Mendix Studio Pro 10.21 vers:all/* Mendix Studio Pro 10.22 vers:all/* Mendix Studio Pro 10.23 vers:all/* Mendix Studio Pro 10.24 vers:intdot/<10.24.21 Mendix Studio Pro 11.0 vers:all/* Mendix Studio Pro 11.1 vers:all/* Mendix Studio Pro 11.10 vers:all/* Mendix Studio Pro 11.11 vers:all/* Mendix Studio Pro 11.2 vers:all/* Mendix Studio Pro 11.3 vers:all/* Mendix Studio Pro 11.4 vers:all/* Mendix Studio Pro 11.5 vers:all/* Mendix Studio Pro 11.6 vers:intdot/<11.6.7 Mendix Studio Pro 11.7 vers:all/* Mendix Studio Pro 11.8 vers:all/* Mendix Studio Pro 11.9 vers:all/* CVSS Vendor Equipment Vulnerabilities v3 5.4 Siemens Siemens Mendix Studio Pro Improper Control of Generation of Code ('Code Injection') Background Critical Infrastructure Sectors: Critical Manufacturing, Energy Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities Expand All + CVE-2026-48192 Affected versions of Mendix Studio Pro do not properly validate or sanitize project files processed during the build pipeline. This could a
CSIRTS triage
- What
- A file parsing vulnerability could allow arbitrary code execution during the build pipeline.
- Who is affected
- Deployments of Mendix Studio Pro versions before 11.12.
- Urgency
- Remediation is critical due to the potential for arbitrary code execution.
- Action
- Update to Mendix Studio Pro version 11.12 or later.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Mendix Studio Pro
Get an email when a new Mendix Studio Pro advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://www.cisa.gov/news-events/ics-advisories/icsa-26-188-04
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-481920.19% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 9% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-48192 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
More from CISA Cybersecurity Advisories
- highCISA Adds Two Known Exploited Vulnerabilities to Catalog2026-07-10
- criticalSchneider Electric PowerChute Serial Shutdown2026-07-09
- criticalOpenPLC v32026-07-09
- criticalSchneider Electric Easergy MiCOM Px40 Series2026-07-09
- highCISA Adds One Known Exploited Vulnerability to Catalog2026-07-07