CVE-2026-48192

Deferred Deferred - Pending Action

Mendix Studio Pro Arbitrary Code Execution Vulnerability

Publication date: 2026-06-30

Last updated on: 2026-07-02

Assigner: Siemens AG

Description

A vulnerability has been identified in Mendix Studio Pro 10.11 (All versions), Mendix Studio Pro 10.12 (All versions), Mendix Studio Pro 10.13 (All versions), Mendix Studio Pro 10.14 (All versions), Mendix Studio Pro 10.15 (All versions), Mendix Studio Pro 10.16 (All versions), Mendix Studio Pro 10.17 (All versions), Mendix Studio Pro 10.18 (All versions), Mendix Studio Pro 10.19 (All versions), Mendix Studio Pro 10.20 (All versions), Mendix Studio Pro 10.21 (All versions), Mendix Studio Pro 10.22 (All versions), Mendix Studio Pro 10.23 (All versions), Mendix Studio Pro 10.24 (All versions < V10.24.21), Mendix Studio Pro 11.0 (All versions), Mendix Studio Pro 11.1 (All versions), Mendix Studio Pro 11.10 (All versions), Mendix Studio Pro 11.11 (All versions), Mendix Studio Pro 11.2 (All versions), Mendix Studio Pro 11.3 (All versions), Mendix Studio Pro 11.4 (All versions), Mendix Studio Pro 11.5 (All versions), Mendix Studio Pro 11.6 (All versions < V11.6.7), Mendix Studio Pro 11.7 (All versions), Mendix Studio Pro 11.8 (All versions), Mendix Studio Pro 11.9 (All versions). Affected versions of Mendix Studio Pro do not properly validate or sanitize project files processed during the build pipeline. This could allow an attacker who tricks a user into opening and running a specially crafted malicious project locally on their system to execute arbitrary code in the context of that user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-30

Last Modified

2026-07-02

Generated

2026-07-20

AI Q&A

2026-06-30

EPSS Evaluated

2026-07-19

NVD

CVE-2026-48192

EUVD

EUVD-2026-40330

Affected Vendors & Products

Vendor	Product	Version / Range
mendix	mendix_studio_pro	10.0
mendix	mendix_studio_pro	11.0
mendix	mendix_studio_pro	to 11.6.7 (exc)
mendix	mendix_studio_pro	to 10.24.21 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability affects Mendix Studio Pro versions before V11.12 and certain earlier versions. It arises because the software does not properly validate or sanitize project files processed during the build pipeline. An attacker can exploit this by tricking a user into opening and running a specially crafted malicious project file locally, which can lead to arbitrary code execution in the context of that user.

Detection Guidance

There are no specific detection commands or network/system scanning methods provided in the available resources for CVE-2026-48192.

The vulnerability involves improper validation or sanitization of project files processed during the build pipeline in Mendix Studio Pro, which could allow arbitrary code execution if a specially crafted malicious project file is opened locally.

To detect if your system is vulnerable, you should verify the version of Mendix Studio Pro installed and check if it is one of the affected versions listed.

Check Mendix Studio Pro version installed on your system.
Ensure that the version is updated to at least V10.24.21 for 10.24 versions or V11.6.7 for 11.6 versions, where fixes are available.

General security best practices include restricting network access to trusted users and following operational guidelines for Industrial Security.

Impact Analysis

If exploited, this vulnerability allows an attacker to execute arbitrary code on your system with the same privileges as the user running Mendix Studio Pro. This can lead to unauthorized actions, potential data compromise, or further system exploitation depending on the user's permissions.

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Mitigation Strategies

To mitigate this vulnerability, Siemens recommends updating Mendix Studio Pro to the latest available versions where fixes have been applied, specifically to version 10.24.21 or later for the 10.24 branch and version 11.6.7 or later for the 11.6 branch.

Additionally, apply general security measures such as protecting network access and following operational guidelines for Industrial Security to reduce the risk of exploitation.

Hi! I’m here to help you understand CVE-2026-48192. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70