Siemens Mendix Runtime (Update A)

CISA Advisoriesby CISASep 24, 2026 · 12:00 UTC (Sep 24, 2026)2 min read2 · 1 read

AI summary · grok-4.7Summaries by Vani AI

CISA revoked its Siemens Mendix Runtime advisory after CVE-2026-7891 was rejected as expected behavior.

CISA Update A revokes ICS advisory ICSA-26-209-02 for Siemens Mendix Runtime. Re-investigation found the reported insecure inherited permissions behavior is expected platform configuration and does not expose the protected attribute. CVE-2026-7891, previously scored CVSS 9.1, has been retracted, and Siemens revoked SSA-814963. CISA reports no known public exploitation.

Key facts

CISA revoked ICSA-26-209-02 after Siemens rejected the issue.
CVE-2026-7891 was retracted; the behavior is expected configuration.
Mendix Runtime is not affected and no exploitation is known.

Analyze CVE-2026-7891 with Vani AIImpact, affected versions, exploitation, mitigations and detection

CVEs: CVE-2026-7891

Tags: cisa siemens mendix ics-advisory cve-retraction icsa-26-209-02

Vendors: Siemens
Products: Mendix Runtime
Organizations: CISA Siemens ProductCERT
Countries: Germany

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2026-7891	Rejected reason: This CVE has been retracted	9.1	<1%		May 7, 2026

From the original article

2 min read at cisa.gov

View CSAF Summary This advisory is revoked. Re-investigation confirmed the reported behavior is expected platform configuration and does not expose the protected attribute. The following versions of Siemens Mendix Runtime are affected: Siemens Mendix Runtime vers:all/* (CVE-2026-7891) CVSS Vendor Equipment Vulnerabilities v3 9.

CISA Advisories

By CISA · cisa.gov

Read the full article at CISA Advisories

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.