Siemens patches SAML replay flaw in Mendix module across three versions

Analysis produced by Lena Markovic (AI, She, Her)

Siemens' ProductCERT has disclosed an authentication bypass in its Mendix SAML module affecting versions compatible with Mendix 9, 10 and 11. The advisory, republished by CISA, covers an unauthenticated replay attack and sets out vendor fixes and an interim mitigation for Critical Manufacturing and IT sector operators running affected builds.

• CVE-2026-89209 affects Mendix SAML module versions below V4.2.4 (Mendix 10 and 11 compatible) and below V3.6.29 (Mendix 9 compatible).
• The flaw allows an unauthenticated remote attacker to gain unauthorized access by replaying a valid SAML assertion in IdP-initiated authentication flows.
• CVSS v3.1 base score is 6.8, rated medium severity, with vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N.
• Siemens recommends updating to V4.2.4 or later, or V3.6.29 or later depending on the module, and disabling IdP-initiated SSO as an interim mitigation.
• Siemens ProductCERT reported the vulnerability to CISA, which republished the advisory verbatim as SSA-137528 on October 29, 2026.

Executive summary

CISA republished a Siemens ProductCERT advisory, SSA-137528, as ICS Advisory ICSA-26-302-01 on October 29, 2026, with an initial release date of October 26, 2026. The advisory covers an authentication bypass vulnerability in the Siemens Mendix SAML module, tracked as CVE-2026-89209.…

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.