Siemens Mendix SAML contains a vulnerability that could let an unauthenticated remote attacker hijack an account session when the module is used in specific single sign-on configurations. The issue, tracked as CVE-2026-80465, involves improper validation of the SAML response signature, according to a CISA advisory that republishes Siemens ProductCERT’s security notice.
The advisory assigns the flaw a CVSS v3.1 base score of 8.7, rated high. Its vector describes a vulnerability exploitable over a network without privileges or user interaction, while also rating attack complexity as high. The stated impact includes high effects on confidentiality and integrity, with no impact listed for availability.
The affected product is the Siemens Mendix SAML module. The advisory identifies affected compatibility lines for Mendix 10, Mendix 11, and Mendix 9.24. The weakness is categorized as CWE-347, or improper verification of a cryptographic signature.
The advisory states that affected versions do not properly validate the SAML response signature. In specific single sign-on configurations, it says, this could allow an unauthenticated remote attacker to hijack an account session. The notice does not identify a particular affected organization or an active attack.
Mendix has provided fixed releases for the module and recommends updating to the latest version. The advisory lists version 3.6.27 or later as a vendor fix for one affected module line and version 4.2.3 or later for the other listed fix entries. The update links in the advisory point to the Mendix Marketplace component page.
Siemens ProductCERT reported the vulnerability to CISA, and the CISA posting says it is a verbatim republication of Siemens advisory SSA-887643, converted directly from the vendor’s Common Security Advisory Framework format. CISA published its republication on September 15, following the advisory’s stated initial release date of September 3.
The notice places the issue in the context of critical manufacturing and information technology sectors and lists deployment as worldwide. Those classifications describe the advisory’s sector and geographic scope. They do not identify a particular affected organization or an active attack.
Until updates are applied, CISA recommends defensive measures intended to reduce exposure. The guidance calls for minimizing network exposure for control-system devices and systems, keeping them inaccessible from the internet, placing control-system networks and remote devices behind firewalls, and isolating them from business networks. When remote access is necessary, CISA recommends more secure methods such as virtual private networks, while noting that VPNs and their connected devices also require current security updates.
CISA also advises organizations to perform impact analysis and risk assessment before deploying defensive measures. Siemens recommends protecting network access, operating devices in a protected information-technology environment, and configuring environments according to its industrial-security guidance and product manuals. Organizations that observe suspected malicious activity are directed to follow established internal procedures and report findings to CISA for tracking and correlation.
The CISA advisory identifies Siemens as the vendor and provides links to Siemens’ ProductCERT resources and industrial-security guidance. It also notes that the CISA posting is provided for informational purposes and directs questions about the vulnerability to Siemens ProductCERT.