Is CVE-2026-89209 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-89209 being exploited in the wild.

How severe is CVE-2026-89209?

High severity, with a CVSS score of 6.8, published 26 October 2026.

Which products and versions are affected?

Siemens Mendix SAML (Mendix 10 compatible) All versions < V4.2.4; Siemens Mendix SAML (Mendix 11 compatible) All versions < V4.2.4; Siemens Mendix SAML (Mendix 9 compatible) All versions < V3.6.29.

Is there a fix for CVE-2026-89209?

Yes: fixed in Mendix SAML (Mendix 9 compatible) V3.6.29 or later; Mendix SAML (Mendix 10 compatible) V4.2.4 or later; Mendix SAML (Mendix 11 compatible) V4.2.4 or later. Until then: Disable IdP-initiated SSO to eliminate the attack vector until patching is possible. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-89209 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-89209?

Check whether you run Siemens Mendix SAML (Mendix 10 compatible), Siemens Mendix SAML (Mendix 11 compatible) or Siemens Mendix SAML (Mendix 9 compatible) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-89209: Mendix SAML authentication bypass in IdP-initiated SSO

Q: Is there a fix for CVE-2026-89209?

Yes: fixed in Mendix SAML (Mendix 9 compatible) V3.6.29 or later; Mendix SAML (Mendix 10 compatible) V4.2.4 or later; Mendix SAML (Mendix 11 compatible) V4.2.4 or later. Until then: Disable IdP-initiated SSO to eliminate the attack vector until patching is possible. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-89209 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-89209?

Check whether you run Siemens Mendix SAML (Mendix 10 compatible), Siemens Mendix SAML (Mendix 11 compatible) or Siemens Mendix SAML (Mendix 9 compatible) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-89209 · Severity: high · CVSS 6.8 · Published 2026-10-26

Mendix SAML is a module that enables user authentication in cloud applications through SAML identity providers. The vulnerability allows unauthenticated attackers to replay captured SAML responses to gain unauthorized access to applications using IdP-initiated single sign-on flows, potentially leading to account takeover and unauthorized access to sensitive data.

Vendors: Siemens.

Quick answers

Is CVE-2026-89209 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-89209 being exploited in the wild.
How severe is CVE-2026-89209?: High severity, with a CVSS score of 6.8, published 26 October 2026.
Which products and versions are affected?: Siemens Mendix SAML (Mendix 10 compatible) All versions < V4.2.4; Siemens Mendix SAML (Mendix 11 compatible) All versions < V4.2.4; Siemens Mendix SAML (Mendix 9 compatible) All versions < V3.6.29.
Is there a fix for CVE-2026-89209?: Yes: fixed in Mendix SAML (Mendix 9 compatible) V3.6.29 or later; Mendix SAML (Mendix 10 compatible) V4.2.4 or later; Mendix SAML (Mendix 11 compatible) V4.2.4 or later. Until then: Disable IdP-initiated SSO to eliminate the attack vector until patching is possible. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-89209 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-89209?: Check whether you run Siemens Mendix SAML (Mendix 10 compatible), Siemens Mendix SAML (Mendix 11 compatible) or Siemens Mendix SAML (Mendix 9 compatible) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Mendix SAML (Mendix 9 compatible) V3.6.29 or later; Mendix SAML (Mendix 10 compatible) V4.2.4 or later; Mendix SAML (Mendix 11 compatible) V4.2.4 or later

Disable IdP-initiated SSO to eliminate the attack vector until patching is possible.

Technical details

The vulnerability is a SAML assertion replay attack (CWE-294) in IdP-initiated authentication flows. Affected versions do not properly validate replay protection on SAML responses, allowing an attacker with network access to capture and reuse a valid SAML assertion for authentication. This requires user interaction (a legitimate login) to capture an assertion, but grants unauthenticated access thereafter.

Affected products

Siemens Mendix SAML (Mendix 9 compatible) All versions < V3.6.29
Siemens Mendix SAML (Mendix 10 compatible) All versions < V4.2.4
Siemens Mendix SAML (Mendix 11 compatible) All versions < V4.2.4

Timeline

2026-10-26: disclosed: Siemens ProductCERT advisory SSA-137528 published

References

https://cert-portal.siemens.com/productcert/html/ssa-137528.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.