SAML Replay in Siemens Mendix: How CVE-2026-89209 Lets Attackers Walk In Without a Password
Executive Summary
In October 2026, CISA republished a Siemens ProductCERT advisory (ICSA-26-302-01 / SSA-137528) disclosing a critical authentication bypass vulnerability—CVE-2026-89209—in the Mendix SAML module across Mendix 9, 10, and 11 compatible versions. The flaw, classified as CWE-294 (Authentication Bypass by Capture-Replay), allows an unauthenticated remote attacker to replay a previously captured valid SAML assertion within IdP-initiated SSO flows, thereby gaining unauthorized application access without valid credentials. Affected versions include Mendix SAML below v4.2.4 (Mendix 10/11) and below v3.6.29 (Mendix 9). Siemens released patched versions and recommended disabling IdP-initiated SSO as an interim mitigation. The vulnerability carries a CVSS v3.1 base score of 6.8 (Medium), with high confidentiality and integrity impact.
SAML replay attacks against low-code and enterprise application platforms are an increasingly favored initial access technique, as they exploit trust relationships between identity providers and service providers rather than brute-forcing credentials. With Mendix widely deployed across critical manufacturing and IT sectors globally, this disclosure underscores the growing risk surface introduced by federated identity in operational technology and enterprise software environments.
Why This Matters Now
IdP-initiated SAML flows remain a systemic weak point across enterprise and low-code platforms, and replay-based authentication bypasses are actively exploited in the wild—requiring no credentials, only a previously intercepted assertion. As organizations expand federated SSO across cloud-native and OT-adjacent environments, unpatched SAML modules in platforms like Mendix represent high-value, low-friction entry points that adversaries can exploit before defenders apply patches.
Attack Path Analysis
An unauthenticated remote attacker exploits CVE-2026-89209 in the Siemens Mendix SAML module by capturing and replaying a valid SAML assertion in an IdP-initiated authentication flow, bypassing identity verification entirely and gaining unauthorized application access. Once inside, the attacker leverages the assumed identity's session privileges to escalate access, move laterally across connected Mendix application services, establish persistence via cloud-native API calls, and potentially exfiltrate sensitive operational or manufacturing data before causing business or process disruption.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
The attacker intercepts or obtains a valid SAML response from a legitimate IdP-initiated SSO flow — for example by monitoring network traffic, leveraging a man-in-the-middle position, or capturing a previously issued assertion — and replays it against the vulnerable Mendix SAML module endpoint. Because the module does not enforce replay protection (missing assertion ID uniqueness checks or expiration enforcement), the forged session is accepted and the attacker gains authenticated access to the Mendix application without valid credentials.
Related CVEs
CVE-2026-89209
CVSS 6.8Siemens Mendix SAML module does not properly protect against SAML assertion replay in IdP-initiated authentication flows, allowing unauthenticated remote attackers to gain unauthorized access by replaying a valid SAML response.
Affected Products:
Siemens Mendix SAML (Mendix 9 compatible) – < 3.6.29
Siemens Mendix SAML (Mendix 10 compatible) – < 4.2.4
Siemens Mendix SAML (Mendix 11 compatible) – < 4.2.4
Exploit Status:
no public exploit
MITRE ATT&CK® Techniques
Forge Web Credentials: SAML Tokens
Use Alternate Authentication Material: Application Access Token
Valid Accounts
Exploit Public-Facing Application
Modify Authentication Process
Brute Force
Data from Cloud Storage
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev. 5 – Identification and Authentication (Non-Organizational Users)
Control ID: IA-8
CISA Zero Trust Maturity Model 2.0 – Continuous Identity Validation and Phishing-Resistant MFA
Control ID: Identity Pillar – Authentication
NIS2 Directive – Policies on Risk Analysis and Incident Handling / Authentication Security
Control ID: Article 21(2)(a) and 21(2)(b)
DORA (Digital Operational Resilience Act) – ICT Access Control and Authentication Management
Control ID: Article 9 – ICT Security
PCI DSS 4.0 – Strong Authentication for All Users
Control ID: Requirement 8.3
ISO/IEC 27001:2022 – Secure Authentication
Control ID: Annex A 8.5
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Information Technology/IT
Siemens Mendix SAML authentication bypass enables unauthenticated replay attacks against IdP-initiated SSO flows, threatening IT platforms relying on federated identity, with lateral movement and privilege escalation risks mapped to NIST.800-53.AC-6.
Industrial Automation
CISA-designated Critical Manufacturing sector deploys Mendix low-code apps on OT networks; SAML assertion replay bypassing authentication exposes industrial control systems to unauthorized access and potential operational disruption.
Government Administration
Government portals leveraging Mendix SAML modules for citizen-facing SSO face authentication bypass exploitation, with ZTMM compliance gaps across identity, network segmentation, and egress enforcement per validated NIST.CSF.PR.AC-4 mappings.
Financial Services
Financial platforms using Mendix for customer or employee SSO portals are exposed to credential-free session hijacking via SAML replay, triggering PCI.4.0.7.2.4 and HIPAA-adjacent zero-trust segmentation compliance failures.
Sources
- Siemens Mendix SAML Modulehttps://www.cisa.gov/news-events/ics-advisories/icsa-26-302-01Verified
- Siemens ProductCERT SSA-137528: Mendix SAML Authentication Bypasshttps://cert-portal.siemens.com/productcert/html/ssa-137528.htmlVerified
- Siemens Industrial Security Operational Guidelineshttps://www.siemens.com/cert/operational-guidelines-industrial-securityVerified
- CISA ICS Security Recommended Practiceshttps://www.cisa.gov/icsVerified
- CWE-294: Authentication Bypass by Capture-replay - MITREhttps://cwe.mitre.org/data/definitions/294.htmlVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant here because a replayed SAML assertion grants an attacker authenticated access that then propagates across interconnected Mendix services, cloud APIs, and potentially OT-adjacent systems. By enforcing identity-aware segmentation and restricting east-west and egress paths, CNSF would likely reduce the attacker's ability to move freely across the environment and limit the blast radius of the compromised session.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: CNSF network-layer controls would likely constrain the reachability of the Mendix SAML endpoint to only explicitly permitted source identities and networks, reducing the opportunity for an unauthenticated external actor to deliver a replayed assertion to the application surface.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation would likely constrain the scope of what the attacker's assumed identity could reach across the environment, reducing the practical value of inherited elevated privileges by limiting which downstream workloads and services that identity is permitted to access.
Control: East-West Traffic Security
Mitigation: East-west traffic enforcement would likely reduce the attacker's ability to move freely between Mendix application tiers and connected backend services, constraining lateral paths by requiring that inter-service traffic be explicitly permitted and monitored at the fabric level.
Control: Multicloud Visibility & Control
Mitigation: Centralized multicloud visibility would likely surface anomalous API call patterns and unusual outbound session behaviors associated with the attacker's use of the Mendix interface, making it more feasible to detect command-and-control activity that blends into normal application traffic flows.
Control: Egress Security & Policy Enforcement
Mitigation: Egress policy enforcement would likely constrain the outbound paths available to the attacker, reducing the number of viable channels through which sensitive manufacturing or operational data could be routed to external destinations outside of approved egress points.
If prior CNSF controls reduced lateral movement and constrained egress, the attacker's ability to reach OT-adjacent systems or manipulate process configurations at scale would likely be meaningfully limited, reducing the scope of achievable disruption within the manufacturing environment.
Impact at a Glance
Affected Business Functions
- Identity and Access Management (IAM) / Single Sign-On (SSO)
- Enterprise Application Authentication and Authorization
- Critical Manufacturing Operations and IT/OT Integration
- Information Technology Service Delivery
Estimated downtime: 1 days
Estimated loss: N/A
Exploitation of this authentication bypass could expose application-level data accessible to legitimate users within Mendix-based enterprise applications. Depending on deployment context within critical manufacturing or IT environments, at-risk data may include business process records, operational parameters, employee records, proprietary manufacturing data, and any information accessible via the Mendix application platform. The replay of a valid SAML assertion grants an attacker the same access rights as the impersonated user, potentially including administrative privileges and sensitive business intelligence.
Recommended Actions
Key Takeaways & Next Steps
- • Apply Zero Trust Segmentation immediately: Deploy identity-based microsegmentation controls around Mendix application tiers to ensure that even if a replayed SAML assertion grants initial access, the compromised session cannot reach internal APIs, databases, or OT-connected services without explicit least-privilege policy authorization aligned with ZTMM.Network and NIST.800-53.AC-6.
- • Enforce Egress Security and Policy on all Mendix outbound traffic: Implement FQDN-based egress filtering and outbound traffic inspection via Cloud Firewall (ACF) and Egress Security controls to detect and block unauthorized data exfiltration attempts from the Mendix application tier to unknown or attacker-controlled destinations, aligning with ZTMM.Data and NIST.CSF.PR.DS-5.
- • Enable East-West Traffic Visibility and Control: Deploy east-west traffic inspection between Mendix application services and downstream integrations to detect anomalous workload-to-workload communications indicative of lateral movement following an authentication bypass, consistent with ZTMM.Network and NIST.800-53.SC-7.
- • Activate Multicloud Visibility for anomalous SAML session behavior: Leverage centralized traffic observability and control plane analytics to baseline normal Mendix user session patterns and alert on repeated, anomalous, or duplicate SAML assertion usage — particularly from unusual source IPs or outside normal business hours — aligned with ZTMM.CrossCutting.Visibility and NIST.800-53.AU-6.
- • Deploy Inline IPS signatures for SAML replay patterns and update Mendix immediately: Enable Suricata-based inline IPS rules targeting SAML assertion replay and known CVE-2026-89209 exploit traffic patterns while simultaneously applying vendor patches (V4.2.4+ for Mendix 10/11, V3.6.29+ for Mendix 9) or disabling IdP-initiated SSO as an interim mitigation, consistent with NIST.800-53.SI-4 and NIST.CSF.DE.CM-4.
