CVE-2026-48192
Received Received - Intake

Mendix Studio Pro Arbitrary Code Execution Vulnerability

Publication date: 2026-06-30

Last updated on: 2026-06-30

Assigner: Siemens AG

Description
A vulnerability has been identified in Mendix Studio Pro 10.11 (All versions), Mendix Studio Pro 10.12 (All versions), Mendix Studio Pro 10.13 (All versions), Mendix Studio Pro 10.14 (All versions), Mendix Studio Pro 10.15 (All versions), Mendix Studio Pro 10.16 (All versions), Mendix Studio Pro 10.17 (All versions), Mendix Studio Pro 10.18 (All versions), Mendix Studio Pro 10.19 (All versions), Mendix Studio Pro 10.20 (All versions), Mendix Studio Pro 10.21 (All versions), Mendix Studio Pro 10.22 (All versions), Mendix Studio Pro 10.23 (All versions), Mendix Studio Pro 10.24 (All versions < V10.24.21), Mendix Studio Pro 11.0 (All versions), Mendix Studio Pro 11.1 (All versions), Mendix Studio Pro 11.10 (All versions), Mendix Studio Pro 11.11 (All versions), Mendix Studio Pro 11.2 (All versions), Mendix Studio Pro 11.3 (All versions), Mendix Studio Pro 11.4 (All versions), Mendix Studio Pro 11.5 (All versions), Mendix Studio Pro 11.6 (All versions < V11.6.7), Mendix Studio Pro 11.7 (All versions), Mendix Studio Pro 11.8 (All versions), Mendix Studio Pro 11.9 (All versions). Affected versions of Mendix Studio Pro do not properly validate or sanitize project files processed during the build pipeline. This could allow an attacker who tricks a user into opening and running a specially crafted malicious project locally on their system to execute arbitrary code in the context of that user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-06-30
Last Modified
2026-06-30
Generated
2026-06-30
AI Q&A
2026-06-30
EPSS Evaluated
N/A
NVD
CVE-2026-48192
EUVD
EUVD-2026-40330

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
mendix mendix_studio_pro 10.0
mendix mendix_studio_pro 11.0
mendix mendix_studio_pro to 11.6.7 (exc)
mendix mendix_studio_pro to 10.24.21 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Executive Summary

This vulnerability affects Mendix Studio Pro versions before V11.12 and certain earlier versions. It arises because the software does not properly validate or sanitize project files processed during the build pipeline. An attacker can exploit this by tricking a user into opening and running a specially crafted malicious project file locally, which can lead to arbitrary code execution in the context of that user.

Impact Analysis

If exploited, this vulnerability allows an attacker to execute arbitrary code on your system with the same privileges as the user running Mendix Studio Pro. This can lead to unauthorized actions, potential data compromise, or further system exploitation depending on the user's permissions.

Mitigation Strategies

To mitigate this vulnerability, Siemens recommends updating Mendix Studio Pro to the latest available versions where fixes have been applied, specifically to version 10.24.21 or later for the 10.24 branch and version 11.6.7 or later for the 11.6 branch.

Additionally, apply general security measures such as protecting network access and following operational guidelines for Industrial Security to reduce the risk of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48192. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart