CISA has revoked its advisory for Siemens Mendix Runtime after a re-investigation found that the reported behavior was an expected platform configuration rather than a security vulnerability. The agency said the behavior does not expose the protected application-specific attribute and classified Siemens Mendix Runtime as not affected.

The updated advisory also rejects CVE-2026-7891, which had been associated with insecure inherited permissions in the runtime. CISA states that vulnerable code is not present. The advisory lists the affected product range as vers:all/*, but its updated product status is “not affected,” reflecting the revised finding rather than a version-specific software fix.

The issue had previously been assigned a CVSS base score of 9.1, rated critical, under both CVSS 3.1 and CVSS 4.0. The metrics in the advisory describe a network-accessible condition requiring no privileges or user interaction, with potential effects on confidentiality and integrity. Those metrics remain part of the record of the earlier assessment, while the current disposition rejects the CVE and withdraws the vulnerability determination.

CISA’s revision history records the advisory’s progression. It was initially published on July 14, 2026, and republished on July 28 with Siemens ProductCERT advisory SSA-814963. The notice was marked revoked on Sept. 22 after the CVE was rejected. The latest update, dated Sept. 24, followed Siemens’ revocation of SSA-814963 and the rejection of CVE-2026-7891.

The advisory identifies critical manufacturing as the relevant critical-infrastructure sector and lists worldwide deployment. It also records that Siemens ProductCERT reported the issue to CISA. CISA said no known public exploitation specifically targeting the reported vulnerability had been reported at the time of the update.

Because the reported behavior is now considered expected platform configuration, the advisory does not identify a patch or version-specific remediation for CVE-2026-7891. Its remaining guidance is general industrial-security advice. CISA recommends minimizing network exposure for control-system devices and systems, keeping them inaccessible from the public internet, placing control-system networks and remote devices behind firewalls, and isolating them from business networks.

For remote access, the agency recommends more secure methods such as virtual private networks. It also cautions that VPNs can contain vulnerabilities, should be updated to the latest available version, and are only as secure as the devices connected to them. CISA advises organizations to perform appropriate impact analysis and risk assessment before deploying defensive measures.

Siemens’ general recommendations in the advisory call for protecting network access with appropriate mechanisms and configuring operating environments according to its industrial-security guidelines and product manuals. The notice also directs users to Siemens’ industrial-security resources and the associated ProductCERT advisory.

CISA further encourages organizations to use broader industrial-control-system security practices, including defense-in-depth strategies and guidance for detecting and mitigating targeted cyber intrusions. Organizations that observe suspected malicious activity should follow their established internal procedures and report findings to CISA for tracking and correlation.

The revised status changes the significance of the original alert. The advisory no longer identifies a confirmed vulnerability in Siemens Mendix Runtime, and CVE-2026-7891 is rejected. Operators nevertheless retain the agency’s general recommendations for reducing network exposure and protecting industrial-control environments. CISA advisory

Byline: Security Innovation Lab News Desk