Security1 publisher2 min readPublished
Siemens patches a Mendix SAML module that failed to validate response signatures
CVE-2026-80465 lets an unauthenticated remote attacker hijack an account in some single sign-on setups. The fix is a Mendix Marketplace module update. It has to be taken app by app across three version trains.
The Watch · Security desk
What happened
- CISA published ICSA-26-258-06 on the Siemens Mendix SAML module, a verbatim republication of Siemens ProductCERT advisory SSA-887643 converted from the vendor's CSAF file.
- Siemens tracks the defect as CVE-2026-80465: affected versions of the module do not properly validate the SAML response signature.
- CISA lists deployment as worldwide and the exposed sectors as Critical Manufacturing and Information Technology, with Siemens headquartered in Germany.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- capability No password, token or user interaction is needed on the attacker side, so secret rotation and password policy do nothing to reduce this exposure.
- decision The remedy is a module version inside each application, so the work falls on whoever owns each Mendix app, and a single platform patch window will not cover apps still on the 9.24 train.
- constraint Siemens does not say which SSO configurations qualify, so defenders cannot triage by SSO setup and have to treat every deployment carrying the module as in scope.
In a SAML login, the signature on the response is the only proof that the assertion came from the identity provider and not from the browser that posted it. Siemens classed CVE-2026-80465 as CWE-347, improper verification of a cryptographic signature [6][3]. The advisory says the defect "could allow unauthenticated remote attackers to hijack an account (session) in specific SSO configurations" [2].
Three affected product entries resolve to two fix versions. The Mendix 10 and Mendix 11 builds of the module both fix at V4.2.3; the Mendix 9.24 build fixes at V3.6.27 [4][5][12]. All three remediation entries point at the same Mendix Marketplace component page [5]. So before anyone can say an app is patched, they have to know which Mendix major version that app targets.
The recommended practices attached to the advisory are the standard industrial control set: minimize network exposure, keep systems off the internet, place them behind firewalls isolated from business networks, and use a VPN when remote access is required [10]. A SAML assertion consumer endpoint is reachable by the people who log in through it. For an internet-facing Mendix app, that guidance does not change who can post a SAML response to the login path; only the module version decides whether the response is checked [2].
The advisory does not include a CVSS score or say whether the flaw has been exploited [9]. Siemens ProductCERT reported the vulnerability to CISA itself, and CISA republished the vendor advisory SSA-887643 verbatim from the CSAF source [8][1].
What to watch
- Whether Siemens updates SSA-887643 with a CVSS score or names the SSO configurations that are exploitable.
- A public proof of concept or exploitation report for CVE-2026-80465 would move this from a scheduled module update to an emergency one.
- Whether Mendix pushes the fixed module into cloud-hosted apps or leaves the update entirely to app owners.