Update to Mendix SAML Module version 4.2.4 or later (Mendix 10/11) or 3.6.29 or later (Mendix 9). As a temporary mitigation, disable IdP-initiated SSO. Follow CISA recommendations to minimize network exposure, place control system networks behind firewalls, and use updated VPNs for remote access.
Quick answers
What is CVE-2026-89209?
Update to Mendix SAML Module version 4.2.4 or later (Mendix 10/11) or 3.6.29 or later (Mendix 9). As a temporary mitigation, disable IdP-initiated SSO. Follow CISA recommendations to minimize network exposure, place control system networks behind firewalls, and use updated VPNs for remote access.
How severe is CVE-2026-89209?
medium, CVSS 6.8
Is CVE-2026-89209 known to be exploited?
It is not marked known-exploited in this record.
How should CVE-2026-89209 be mitigated?
Update to Mendix SAML Module version 4.2.4 or later (Mendix 10/11) or 3.6.29 or later (Mendix 9). As a temporary mitigation, disable IdP-initiated SSO. Follow CISA recommendations to minimize network exposure, place control system networks behind firewalls, and use updated VPNs for remote access.
Update to Mendix SAML Module version 4.2.4 or later (Mendix 10/11) or 3.6.29 or later (Mendix 9). As a temporary mitigation, disable IdP-initiated SSO. Follow CISA recommendations to minimize network exposure, place control system networks behind firewalls, and use updated VPNs for remote access.
Siemens ProductCERT has disclosed an authentication bypass vulnerability in the Mendix SAML module affecting versions prior to 4.2.4 (Mendix 10/11 compatible) and 3.6.29 (Mendix 9 compatible). Tracked as CVE-2026-89209 with a CVSS v3.1 base score of 6.8 (MEDIUM), the flaw stems from improper protection against SAML assertion replay in IdP-initiated authentication flows. An unauthenticated remote attacker could replay a valid SAML assertion to gain unauthorized access to the application. Siemens has released updated versions and recommends immediate updating or disabling IdP-initiated SSO as a temporary mitigation.