Siemens Mendix SAML contains a vulnerability that could let unauthenticated remote attackers hijack user accounts or sessions in specific single sign-on configurations, the Cybersecurity and Infrastructure Security Agency said in an advisory republishing information from Siemens ProductCERT. The issue is tracked as CVE-2026-80465 and affects the module’s handling of SAML response signatures.

The flaw is classified as CWE-347, or improper verification of a cryptographic signature. In affected versions, the module does not properly validate the signature on a SAML response. Under the configurations described in the advisory, that failure could allow an attacker to hijack an account session without authenticating first. The advisory does not describe a confirmed exploitation campaign or provide details of attacks in the wild.

CISA lists the vulnerability with a CVSS version 3.1 base score of 8.7, rated high. The score’s vector identifies network reachability and no required privileges or user interaction. It also assigns high potential impacts to confidentiality and integrity, while giving the vulnerability a high attack-complexity value. That rating indicates that exploitation depends on conditions beyond simple network access.

The advisory identifies affected product lines as Siemens Mendix SAML modules compatible with Mendix 9.24, Mendix 10 and Mendix 11. Its affected-product listings do not provide a complete version-by-version explanation of how each compatibility line corresponds to the remediation versions. Organizations therefore need to determine which compatible module release is installed before selecting an update.

Mendix has provided fix releases for the module and recommends updating to the latest version. The advisory lists V3.6.27 or later as a vendor fix for one affected product line and V4.2.3 or later for two others. The listed remediation links point to the Mendix Marketplace component page at https://marketplace.mendix.com/link/component/1174. Users should use the applicable fixed release for their installed compatibility line rather than treating the version numbers as interchangeable.

The advisory lists critical manufacturing and information technology as relevant critical-infrastructure sectors and records deployment as worldwide. It also identifies Germany as the location of the vendor’s headquarters. ProductCERT reported the vulnerability to CISA, which republished Siemens’ SSA-887643 advisory to increase visibility.

Organizations using the module should identify deployments that rely on SAML-based single sign-on, determine the installed compatible release and apply the applicable vendor fix. Administrators should also review the SSO configurations in which the module is used, because the account-hijacking risk described by CISA is tied to specific SSO configurations rather than presented as a result for every deployment.

Siemens recommends protecting network access to devices with appropriate mechanisms and configuring operating environments according to its industrial-security guidance and product manuals. The advisory directs users to Siemens’ industrial security information at https://www.siemens.com/industrialsecurity and to its ProductCERT resources at https://www.siemens.com/cert/advisories.

CISA recommends minimizing network exposure for control-system devices and systems and ensuring they are not accessible from the internet. The agency advises placing control-system networks and remote devices behind firewalls and isolating them from business networks. Before deploying defensive measures, organizations should perform an impact analysis and risk assessment.

Where remote access is required, CISA recommends more secure methods such as virtual private networks. The agency also cautions that VPNs may contain vulnerabilities and should be updated to the most recent available version, and that VPN security depends on the devices connected to them. Organizations that observe suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation.