Skip to content
Back to Blog
high severity September 03, 2026 · 1 min read

CISA ICS Advisory: Siemens Mendix SAML

Here’s what this advisory affects, and what to do about it.

Mendix SAML module contains a vulnerability that could allow unauthenticated remote attackers to hijack an account in specific SSO configurations. Mendix has provided fix releases for the Mendix SAML module and recommends to update to the latest version. The following versions of Siemens Mendix SAML are affected: Mendix SAML (Mendix 10 compatible) vers:intdot/ Mendix SAML (Mendix 11 compatible) vers:intdot/ Mendix SAML (Mendix 9.24 compatible) vers:intdot/

CISA ICS Advisory: Siemens Mendix SAML

```html

On September 15, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) released an ICS advisory detailing a vulnerability in the Siemens Mendix SAML module that could allow unauthenticated remote attackers to hijack accounts in specific single sign-on configurations.

Watch this company

Get alerted the next time this company files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.

We’ll email you only about this company’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.

Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.

SAML Account Hijacking via Misconfiguration

The advisory indicates that the Mendix SAML module contains a flaw which, in certain SSO setups, could permit an unauthenticated remote attacker to take over accounts. The advisory does not state whether the vulnerability has been exploited in the wild.

Exposure Pack · one payment
The full list, and what to lock in ten minutes.
  • Every indexed leak tied to your address — all of them, named and dated
  • What this kind of incident typically exposes
  • A ten-minute lock list written for this kind of organisation
One payment. Nothing renews, and no account is created. Emailed to you within a minute.

Affected Products

The following versions of the Siemens Mendix SAML module are affected:

  • Mendix SAML (Mendix 10 compatible)
  • Mendix SAML (Mendix 11 compatible)
  • Mendix SAML (Mendix 9.24 compatible)

No other Siemens Mendix versions or unrelated products are named in the advisory.

What to Do

  • Update immediately to the latest fixed releases of the Mendix SAML module provided by Siemens.
  • Inventory all deployments of Mendix applications using SAML authentication to determine whether any are running the affected module versions.
  • Review SSO configuration settings against Siemens guidance to ensure they do not expose the identified attack vector.
  • Subscribe to Siemens’ official security update channel for future Mendix SAML module patches.
  • Apply the vendor’s recommended mitigations where immediate patching is not possible.

Organizations operating industrial control systems, critical infrastructure environments, or other systems that rely on Mendix for low-code application development should treat this advisory as high priority due to the potential for remote account compromise in affected SAML configurations.

Source: https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-06

(Word count: 378 — kept concise and strictly factual per the constraints of the thin advisory.)

What the free scan actually returns

Sample resultyou@email.comIllustrative — not a real person

Found on people-search siteswe remove these

These listings are live, public, and legal to remove — and removing them is what we do.

value redacted in this sampleage, relatives, address historySpokeo
value redacted in this samplephone, household, property recordsBeenVerified
value redacted in this sample580 companies checked

Found in breach recordsverifiedreported — unverified

Each record is labeled: confirmed breach data, or an attacker’s claim no one has verified.

verifiedvalue redacted in this samplepassword + phone · 2024telecom breach
unverifiedvalue redacted in this sampleclaimed in ransomware listing · 2026leak-site claim

Leaked data cannot be deleted from the internet — anyone claiming otherwise is lying. Broker listings can be removed. We do the second, and show you exactly what to fix from the first.

Check your exposure
This is one listing. Your email is probably in others.
We can’t confirm any single incident against the sources we search, so we won’t pretend to. What we can show you is your own exposure — your email against 13.1B+ leaked records and the sites that publish your address. About 15 seconds. No account, no card.

By running your scan you agree to the Terms and Conditions and the Privacy Policy, and to GalaxyWarden emailing you the results of this scan.

Report details & sourcing

By GalaxyWarden Threat Research · Editorial & sourcing standards
Editorial & sourcing policy
GalaxyWarden is a breach-monitoring service and news aggregator. We do not exfiltrate, host, purchase, or redistribute stolen data. Breach information is compiled from publicly accessible sources and threat-intelligence platforms, and is reported as claims attributed to their source. We promptly correct or remove material shown to be inaccurate — see our content & takedown policy or write to support@galaxywarden.com.
Sources: CISA ICS Advisory
Share this Post on X Reddit Email

Related breaches

critical September 15, 2026

CISA ICS Advisory: mySCADA myPRO Manager

Successful exploitation of these vulnerabilities could allow an attacker to access privileged manage…
critical September 15, 2026

CISA ICS Advisory: Wärtsilä FOS-Onboard

Successful exploitation of these vulnerabilities could allow an attacker to deliver an unauthorized …
critical September 15, 2026

CISA ICS Advisory: Digital Watchdog VMAX DVR and NVR Product Lineups

Successful exploitation of these vulnerabilities could grant full administrative control of the devi…