Security 1 publisher2 min readPublished September 24, 2026 at 5:29 PM PDT

CVE-2026-7891 in Siemens Mendix Runtime is retracted as expected platform configuration

CISA revoked its Siemens Mendix Runtime advisory and marked all versions not affected by CVE-2026-7891, now retracted as expected configuration. OT and application teams holding tickets for it can close them with no Runtime upgrade to schedule.

The Watch · Security desk

Illustration accompanying CVE-2026-7891 in Siemens Mendix Runtime is retracted as expected platform configuration

What happened

A re-investigation found the reported behavior is expected platform configuration and does not expose the protected application-specific attribute.
The advisory states that CVE-2026-7891, the identifier assigned to the reported issue, has been retracted.
Siemens ProductCERT was the party that reported the issue to CISA, according to the advisory's acknowledgments.

Compiled by The WatchSomething wrong?How this is made

Why it matters

decision Remediation tickets for CVE-2026-7891 can close against the not_affected status, with no Runtime upgrade to fit into a plant maintenance window.
cost Because the entry named every Runtime version, the cleanup lands on every Mendix estate that logged it, as scanner findings and risk-register entries to clear.
contradiction A reviewer who reads only the recommended-practices section of the revoked page could reopen a closed ticket, since that section still urges defense against exploitation.

There is nothing here for an attacker to use ^[2]. CISA said no known public exploitation specifically targeting the issue had been reported to it ^[7].

The scope was the whole product. The entry covered Mendix Runtime at vers:all/*, meaning every version, and listed the Critical Manufacturing sector with worldwide deployment ^[5]^[10]. It now resolves the same way everywhere. Every version carries the not_affected status, and the rejection is labeled "Vulnerable Code Not Present" ^[4]. No fixed release is listed, because there is nothing to fix ^[4].

The timeline on the page is short. The revision history holds one entry, the initial release on 2026-07-14 ^[11], while the page itself is titled Update A ^[1]. CISA refers readers to Siemens security advisory SSA-814963, in HTML and in the machine-readable CSAF format ^[6]. The CISA page does not say whether the Siemens document has been revised to match.

Parts of the revoked page still describe a live flaw. It keeps the tag CWE-277, Insecure Inherited Permissions ^[8]. Its recommended practices still say CISA "recommends users take defensive measures to minimize the risk of exploitation of this vulnerability" ^[9]. Higher up, the same page says the vulnerability is rejected ^[4]. Siemens frames its advice to protect network access to devices as "a general security measure" ^[13], and that advice stands apart from this CVE.

This is a one-off correction to the advisory record. Application teams that changed Mendix settings as a precaution can keep or revert those changes on their own merits. The re-investigation classes the original behavior as expected platform configuration and finds the protected attribute unexposed ^[2].

What to watch

Siemens revising SSA-814963, including its CSAF file, to carry the same rejected, not_affected status the CISA page shows.
The public CVE record for CVE-2026-7891 showing the rejection, so findings keyed to the CVE ID clear without manual overrides.

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[4]
The advisory lists Siemens Mendix Runtime vers:all/* as not_affected and states the vulnerability is rejected (Vulnerable Code Not Present); no fixed version is listed.
ReportedSupported2 sources— sign in to open View cited source
[5]
The advisory's affected-product entry for CVE-2026-7891 covered Siemens Mendix Runtime vers:all/*, meaning all versions.
ReportedSupported2 sources— sign in to open View cited source
[1]
CISA's advisory titled 'Siemens Mendix Runtime (Update A)' states: 'This advisory is revoked.'
ReportedSupportedView cited source
[2]
Re-investigation confirmed the reported behavior is expected platform configuration and does not expose the protected application-specific attribute.
ReportedSupportedView cited source
[3]
The advisory states that CVE-2026-7891 has been retracted.
ReportedSupportedView cited source
[6]
The advisory refers readers to the associated Siemens security advisory SSA-814963 in HTML and in CSAF.
ReportedSupportedView cited source
[7]
No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
ReportedSupportedView cited source
[8]
The advisory lists CWE-277 Insecure Inherited Permissions as the relevant CWE.
ReportedSupportedView cited source
[9]
CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.
ReportedSupportedSource: CISA advisory, Recommended Practices sectionView cited source
[10]
The advisory lists Critical Manufacturing as the critical infrastructure sector, deployment as worldwide, and Germany as the company headquarters location.
ReportedSupportedView cited source
[11]
The advisory's revision history lists an initial release date of 2026-07-14.
ReportedSupportedView cited source
[12]
Siemens ProductCERT reported this vulnerability to CISA.
ReportedSupportedView cited source
[13]
As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms.
ReportedSupportedSource: Siemens, as reproduced in the CISA advisoryView cited source

Sources

Publishers with included, body-backed reporting in this cluster.

cisa.gov
1 article · September 24, 2026
Siemens Mendix Runtime (Update A)

Ask Clarity

Have a question this piece left open? The answer comes from its reporting and claim ledger — nothing else.

Try

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

The retracted report was about an application-specific attribute in Mendix Runtime. CISA says re-investigation found the behavior is expected platform configuration and the attribute is not exposed. The advisory doesn't describe the behavior or the configuration, so a Mendix developer can't tell from this text whether their own app's attribute protection matches what Siemens treats as expected. For that detail, CISA points to Siemens' SSA-814963, which is outside our coverage.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence72: 0100
Primary record, thin rationale
The retraction comes from the government advisory itself. It marks every Mendix Runtime version not_affected and gives the reason as 'Vulnerable Code Not Present'. The technical basis is a single sentence saying the behavior is expected platform configuration. Siemens' SSA-814963 would have the fuller reasoning, and it is outside our coverage.
AdoptionInsufficient: Not measurable
CISA tags Mendix Runtime as deployed worldwide in critical manufacturing. That is a sector label with no count of installations or users, so we can't score how widely the software runs.
Hype gap0: −100 understated0 aligned+100 overstated
Aligned
Our headline says the CVE is retracted and no upgrade is needed. The advisory says the same thing: all versions not affected, no fixed version, and no exploitation reported to CISA. The one mismatch is inside CISA's own text. A summary line still lists all versions as 'affected' above the not_affected status.
IncentivesInsufficient: Not scored
Siemens ProductCERT, the vendor's own security team, reported the issue, and the vendor's SSA-814963 is the reference for the retraction. CISA doesn't say who re-investigated or what was tested. This reporting gives no basis for scoring any party's stake in the outcome.
Confidence68: 0100
Firm on status, thinner on substance
We have high confidence that the status changed, because CISA's advisory is the official record of that change. We have less confidence in the reasoning behind it. The only explanation offered is one sentence, and nobody outside Siemens and CISA has examined the finding in our coverage.

Topics and entities

Follow any of these and your For You feed starts watching them — no settings page required.

CVE-2026-7891 in Siemens Mendix Runtime is retracted as expected platform configuration

What happened

Why it matters

What to watch

Claim ledger

Sources

Topics and entities

Topics

Entities

Claim ledger

Topics and entities

Topics

Entities

Perspective Coverage

Reality

Sources

What happened

Why it matters

What to watch

Claim ledger

Sources

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Related stories

Claim ledger

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Perspective Coverage

Reality

Related stories

Sources