Siemens Mendix Studio Pro Code Injection Flaw

7 July 2026 medium vulnerability manufacturingenergy

A code injection vulnerability in Siemens Mendix Studio Pro can let attackers execute arbitrary code if a user opens a malicious project file during the build pipeline.

Siemens has disclosed CVE-2026-48192, a code injection vulnerability affecting numerous versions of Mendix Studio Pro, its low-code application development environment. The flaw stems from improper validation and sanitization of project files processed during the build pipeline, allowing an attacker who convinces a user to open and build a specially crafted malicious project to execute arbitrary code in the context of that user.

The vulnerability affects a broad swath of Studio Pro 10.x and 11.x releases. Siemens has released fixed versions for the 10.24 and 11.6 branches (V10.24.21 and V11.6.7 respectively), but has stated no fix is currently planned for several other affected version lines, leaving those users reliant on general mitigations. This is a local, user-interaction-dependent attack vector rather than remotely exploitable, and there is no indication of active exploitation in the wild.

CISA republished this as a verbatim conversion of Siemens ProductCERT advisory SSA-779310, applicable to critical manufacturing and energy sectors worldwide given Mendix's use in industrial application development. Organizations are advised to apply available vendor fixes where possible, restrict network exposure of engineering systems, and follow standard ICS defense-in-depth guidance since not all affected versions have a patch available.

Mentioned in this report

Vulnerabilities CVE-2026-48192

Detection guidance

Suspicious Child Process Spawned by Mendix Studio Pro

ATT&CK T1204.002

Detects Mendix Studio Pro launching command interpreters or scripting engines shortly after opening/building a project, consistent with exploitation of CVE-2026-48192 code injection via a malicious project file Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Child Process from Mendix Studio Pro
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \Mendix Studio Pro.exe
    - \StudioPro.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
  condition: selection
falsepositives:
- Legitimate Studio Pro plugins, module marketplace scripts, or automated build tooling
  that intentionally invoke shell utilities
- Custom deployment or CI scripts wired into the Mendix build pipeline
level: medium
tags:
- attack.t1204.002
- attack.execution
id: 56968d6f-82f4-5411-a616-e6d113af79de
status: experimental
author: Vorant

Mendix Studio Pro Build Process Writing Executable Content

ATT&CK T1204.002

Detects Mendix Studio Pro (or its build/compile subprocess) writing new executable or script files to disk immediately during a project build, which may indicate arbitrary code delivered via a malicious project exploiting CVE-2026-48192 Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Executable File Dropped by Mendix Studio Pro Build Process
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
    - \Mendix Studio Pro.exe
    - \StudioPro.exe
    TargetFilename|endswith:
    - .exe
    - .dll
    - .ps1
    - .bat
    - .vbs
    - .hta
  filter:
    TargetFilename|contains:
    - \deployment\
    - \bin\
    - \Program Files\Mendix\
  condition: selection and not filter
falsepositives:
- Normal Studio Pro build output written to expected deployment or bin directories
- Third-party module installation that legitimately drops DLLs during build
level: medium
tags:
- attack.t1204.002
- attack.execution
id: 17525589-1fd5-52ea-9d87-c838f21de8d8
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-188-04

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free