CVE-2026-48192

criticalCVSS 5.4covered by 2 sourcesfirst seen 2026-06-30

View CSAF Summary Mendix Studio Pro versions before V11.12 are affected by a file parsing vulnerability that could be triggered when the application reads specially crafted malicious project during the build pipeline. This could allow an attacker to execute arbitrary code in the context of that user. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available. The following versions of Siemens Mendix Studio Pro are affected: Mendix Studio Pro 10.11 vers:all/* Mendix Studio Pro 10.12 vers:all/* Mendix Studio Pro 10.13 vers:all/* Mendix Studio Pro 10.14 vers:all/* Mendix Studio Pro 10.15 vers:all/* Mendix Studio Pro 10.16 vers:all/* Mendix Studio Pro 10.17 vers:all/* Mendix Studio Pro 10.18 vers:all/* Mendix Studio Pro 10.19 vers:all/* Mendix Studio Pro 10.20 vers:all/* Mendix Studio Pro 10.21 vers:all/* Mendix Studio Pro 10.22 vers:all/* Mendix Studio Pro 10.23 vers:all/* Mendix Studio Pro 10.24 vers:intdot/<10.24.21 Mendix Studio Pro 11.0 vers:all/* Mendix Studio Pro 11.1 vers:all/* Mendix Studio Pro 11.10 vers:all/* Mendix Studio Pro 11.11 vers:all/* Mendix Studio Pro 11.2 vers:all/* Mendix Studio Pro 11.3 vers:all/* Mendix Studio Pro 11.4 vers:all/* Mendix Studio Pro 11.5 vers:all/* Mendix Studio Pro 11.6 vers:intdot/<11.6.7 Mendix Studio Pro 11.7 vers:all/* Mendix Studio Pro 11.8 vers:all/* Mendix Studio Pro 11.9 vers:all/* CVSS Vendor Equipment Vulnerabilities v3 5.4 Siemens Siemens Mendix Studio Pro Improper Control of Generation of Code ('Code Injection') Background Critical Infrastructure Sectors: Critical Manufacturing, Energy Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities Expand All + CVE-2026-48192 Affected versions of Mendix Studio Pro do not properly validate or sanitize project files processed during the build pipeline. This could a

CSIRTS triage

What: A file parsing vulnerability could allow arbitrary code execution during the build pipeline.
Who is affected: Deployments of Mendix Studio Pro versions before 11.12.
Urgency: Remediation is critical due to the potential for arbitrary code execution.
Action: Update to Mendix Studio Pro version 11.12 or later.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch CVE-2026-48192

Get an email if CVE-2026-48192 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.19% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 9% of all EPSS-scored CVEs.

Advisory coverage (2)

criticalSiemens Mendix Studio Procisa · 2026-07-07
mediumCVE-2026-48192: A vulnerability has been identified in Mendix Studio Pro 10.11 (All versions), Mendix Studio P…nvd · 2026-06-30

External references

NVD record for CVE-2026-48192

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-48192 status](https://www.csirts.com/badge/CVE-2026-48192)](https://www.csirts.com/cve/CVE-2026-48192)