Siemens Mendix Studio Pro Code Injection Flaw
A code injection vulnerability in Siemens Mendix Studio Pro can let attackers execute arbitrary code if a user opens a malicious project file during the build pipeline.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
Siemens has disclosed CVE-2026-48192, a code injection vulnerability affecting numerous versions of Mendix Studio Pro, its low-code application development environment. The flaw stems from improper validation and sanitization of project files processed during the build pipeline, allowing an attacker who convinces a user to open and build a specially crafted malicious project to execute arbitrary code in the context of that user.
The vulnerability affects a broad swath of Studio Pro 10.x and 11.x releases. Siemens has released fixed versions for the 10.24 and 11.6 branches (V10.24.21 and V11.6.7 respectively), but has stated no fix is currently planned for several other affected version lines, leaving those users reliant on general mitigations. This is a local, user-interaction-dependent attack vector rather than remotely exploitable, and there is no indication of active exploitation in the wild.
CISA republished this as a verbatim conversion of Siemens ProductCERT advisory SSA-779310, applicable to critical manufacturing and energy sectors worldwide given Mendix's use in industrial application development. Organizations are advised to apply available vendor fixes where possible, restrict network exposure of engineering systems, and follow standard ICS defense-in-depth guidance since not all affected versions have a patch available.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by Mendix Studio Pro
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects Mendix Studio Pro launching command interpreters or scripting engines shortly after opening/building a project, consistent with exploitation of CVE-2026-48192 code injection via a malicious project file Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process from Mendix Studio Pro
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \Mendix Studio Pro.exe
- \StudioPro.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
condition: selection
falsepositives:
- Legitimate Studio Pro plugins, module marketplace scripts, or automated build tooling
that intentionally invoke shell utilities
- Custom deployment or CI scripts wired into the Mendix build pipeline
level: medium
tags:
- attack.t1204.002
- attack.execution
id: 56968d6f-82f4-5411-a616-e6d113af79de
status: experimental
author: Vorant
Mendix Studio Pro Build Process Writing Executable Content
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects Mendix Studio Pro (or its build/compile subprocess) writing new executable or script files to disk immediately during a project build, which may indicate arbitrary code delivered via a malicious project exploiting CVE-2026-48192 Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Executable File Dropped by Mendix Studio Pro Build Process
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith:
- \Mendix Studio Pro.exe
- \StudioPro.exe
TargetFilename|endswith:
- .exe
- .dll
- .ps1
- .bat
- .vbs
- .hta
filter:
TargetFilename|contains:
- \deployment\
- \bin\
- \Program Files\Mendix\
condition: selection and not filter
falsepositives:
- Normal Studio Pro build output written to expected deployment or bin directories
- Third-party module installation that legitimately drops DLLs during build
level: medium
tags:
- attack.t1204.002
- attack.execution
id: 17525589-1fd5-52ea-9d87-c838f21de8d8
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-188-04
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs