CISA Withdraws Critical Mendix Runtime Alert After Siemens Finds No Vulnerability

CISA has revoked an industrial-control-system advisory for Siemens Mendix Runtime after a new investigation determined that the reported behavior was an expected platform configuration, not a security flaw.

The agency’s September 24, 2026 update says Siemens withdrew its corresponding ProductCERT advisory, SSA-814963, and rejected CVE-2026-7891. The current product status is not affected.

Although the advisory record still displays critical CVSS ratings and an earlier vulnerability classification, those fields describe a report that has now been withdrawn. They are not evidence of a confirmed, exploitable weakness in Mendix Runtime.

Re-investigation found that protected data was not exposed

The original report concerned behavior classified as CWE-277, or Insecure Inherited Permissions. Such a classification would normally suggest that permissions inherited from another object or configuration could grant access beyond what an application intended.

Siemens’ re-investigation reached a different conclusion. The observed behavior was an expected aspect of the platform’s configuration, and it did not expose the protected application-specific attribute at the center of the report.

That finding removes the basis for treating the behavior as a vulnerability. Siemens therefore revoked SSA-814963, while the CVE record was rejected rather than left active as a confirmed issue.

The National Vulnerability Database record independently gives the same rejection rationale. It does not provide an additional NVD severity score, affected-version information, or other technical evidence contradicting the withdrawal.

The updated CISA advisory consequently describes the Siemens product as not affected. No vulnerability-specific patch is required for the rejected issue.

The all-versions entry does not mean every release is vulnerable

The advisory contains an apparent contradiction that could cause confusion for asset owners and vulnerability-management teams.

Its summary retains an association between Siemens Mendix Runtime, the version expression vers:all/*, and CVE-2026-7891. However, the detailed product record marks the product as not_affected and explains that the CVE has been rejected.

The vers:all/* selector must therefore not be interpreted as confirmation that every Mendix Runtime release contains a critical flaw. In the current record, it is residual scope information attached to the withdrawn report.

No affected Mendix Runtime versions have been identified. More precisely, the advisory says the reported vulnerable code is not present, rather than identifying releases that require remediation.

This distinction matters for automated vulnerability scanners and software-composition systems. Tools that ingest only the CVE identifier, product name, version selector, or historical CVSS score could continue producing false-positive alerts unless they also process the rejection and product-status fields.

Security teams should update local records accordingly. An alert for CVE-2026-7891 should be reviewed against the current status before it triggers emergency patching, isolation, or service interruption.

Critical scores remain visible but no longer describe a valid flaw

The advisory still lists a CVSS v3.1 score of 9.1, rated Critical, with the following vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

It also retains a CVSS v4.0 score of 9.1, again rated Critical:

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

These metrics represented the potential consequences attributed to the original report. They should not be used to overrule the later technical finding that the protected attribute was not exposed.

In other words, the scores describe a hypothetical issue as initially assessed, not the current security status of Mendix Runtime. The rejection of the CVE and the not_affected designation are the controlling conclusions.

CISA also said it had received no reports of public exploitation specifically targeting the reported behavior. Siemens ProductCERT was credited with submitting the original vulnerability report to the agency.

No indicators of compromise have been published for this issue. That is consistent with both the absence of reported exploitation and the conclusion that the suspected vulnerability did not exist as described.

The available information does not establish that CVE-2026-7891 was added to CISA’s Known Exploited Vulnerabilities catalog. No KEV inclusion date or remediation deadline is provided.

The advisory changed status over several revisions

CISA’s revision history shows how the report progressed from publication to withdrawal:

• July 14, 2026: Initial publication.
• July 28, 2026: Initial republication of Siemens ProductCERT advisory SSA-814963.
• September 22, 2026: CISA revoked the advisory after the CVE was rejected.
• September 24, 2026: Update A explained that CISA acted after Siemens revoked SSA-814963 and rejected CVE-2026-7891.

The final revision is significant because it does more than lower the severity or narrow the affected-version range. It withdraws the vulnerability claim itself.

The advisory had identified Critical Manufacturing as the relevant sector, with worldwide deployment and Siemens headquartered in Germany. Those contextual fields explain why the initial report received industrial-security attention, but they do not alter the re-investigation’s outcome.

Asset owners should correct records rather than search for a patch

Organizations running Mendix Runtime do not need to deploy a vulnerability-specific fix for CVE-2026-7891. The practical task is to prevent stale data from driving unnecessary incident response.

Defenders should check vulnerability-management platforms, internal ticketing systems, risk registers, and scanner findings for entries based on the earlier advisory state. Records should reflect that the CVE is rejected and the product is not affected.

Teams should also avoid treating the retained 9.1 scores as active risk ratings. Where automation cannot process rejected CVEs correctly, administrators may need to suppress or annotate the finding manually.

No workaround has been prescribed because the reported vulnerable code is not present. Likewise, there are no issue-specific logs, network signatures, or malicious artifacts for defenders to hunt.

If an organization observes suspicious activity involving a Mendix deployment, it should still investigate under its normal incident-response procedures. Any such activity should not automatically be attributed to this rejected CVE.

General industrial-network protections still apply

The withdrawal does not change Siemens’ broader guidance for securing industrial environments. Network access to devices should be restricted through appropriate controls, and systems should operate inside protected IT environments configured according to product manuals and industrial-security guidelines.

CISA recommends keeping control-system devices and networks off the public internet wherever possible. Control networks and remote devices should sit behind firewalls and remain isolated from business networks.

Where remote access is operationally necessary, organizations should use more secure mechanisms such as VPNs and keep the supporting software updated. A VPN does not eliminate endpoint risk; its security also depends on the devices connecting through it.

Before introducing new defensive controls, operators should perform impact and risk assessments, particularly where changes could affect availability or safety. Defense-in-depth and intrusion-detection measures remain appropriate even though this specific Mendix Runtime report was withdrawn.

The central remediation, however, is administrative rather than technical: recognize that CVE-2026-7891 is rejected, Mendix Runtime is marked not affected, and the critical scores remaining in the record no longer represent a confirmed vulnerability.