CVE-2026-48192: Mendix Studio Pro RCE Vulnerability

CVE-2026-48192 Overview

CVE-2026-48192 is a code injection vulnerability [CWE-94] affecting multiple versions of Siemens Mendix Studio Pro. The flaw stems from improper validation and sanitization of project files processed during the build pipeline. An attacker who convinces a user to open and run a specially crafted malicious project on their local system can execute arbitrary code in the context of that user. The issue affects Mendix Studio Pro 10.11 through 10.24 (prior to V10.24.21) and 11.0 through 11.11 (with V11.6.7 addressing the 11.6 branch). Exploitation requires user interaction and local execution of the malicious project.

Critical Impact
Arbitrary code execution in the context of the developer opening the crafted Mendix project, enabling compromise of developer workstations and downstream build artifacts.

Affected Products

Mendix Studio Pro 10.11 through 10.23 (all versions)
Mendix Studio Pro 10.24 (all versions prior to V10.24.21)
Mendix Studio Pro 11.0 through 11.11 (with 11.6 branch fixed in V11.6.7)

Discovery Timeline

2026-06-30 - CVE-2026-48192 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-48192

Vulnerability Analysis

The vulnerability resides in how Mendix Studio Pro handles project files during its build pipeline. The application processes project artifacts without adequately validating or sanitizing their contents. When a developer opens and builds a specially crafted project, embedded content is interpreted and executed by the build logic. This yields arbitrary code execution under the identity of the user running Mendix Studio Pro.

Because Mendix Studio Pro is a low-code development environment, project files legitimately carry logic, configuration, and build directives. Attackers can weaponize this trust boundary by embedding malicious payloads that the build pipeline processes as code rather than data.

Root Cause

The underlying weakness is classified as Improper Control of Generation of Code [CWE-94]. Project files consumed by the build pipeline are not restricted to a safe grammar or sandboxed interpreter. Content that should be treated as inert data is instead evaluated during the build phase, allowing attacker-controlled instructions to reach code execution paths.

Attack Vector

Exploitation requires social engineering. The attacker distributes a crafted Mendix project through channels such as email, chat, source repositories, or shared drives. When the target opens the project in a vulnerable Mendix Studio Pro version and initiates a build, the malicious content triggers code execution locally. The resulting process inherits the user's privileges, providing a foothold for credential theft, lateral movement, or supply chain tampering of Mendix applications produced from that workstation. Refer to the Siemens Security Advisory SSA-779310 for technical details.

Detection Methods for CVE-2026-48192

Indicators of Compromise

Unexpected child processes spawned by Mendix Studio Pro (StudioPro.exe) such as cmd.exe, powershell.exe, wscript.exe, or mshta.exe during project load or build.
Mendix Studio Pro writing or executing binaries outside standard project, cache, and installation directories.
Outbound network connections initiated by Mendix Studio Pro or its build child processes to untrusted hosts during project builds.
Mendix project files (.mpr, .mpk) received from unverified sources or containing unexpected embedded scripts or references.

Detection Strategies

Deploy EDR rules that flag script interpreters and living-off-the-land binaries spawning from StudioPro.exe or associated build utilities.
Baseline expected file writes and network destinations for developer workstations running Mendix, and alert on deviations during project builds.
Inspect Mendix project archives obtained externally for embedded executable content, unexpected post-build steps, or references to untrusted dependencies before opening.

Monitoring Recommendations

Aggregate process creation, file, and network telemetry from developer endpoints into a central analytics platform for correlation across build activity.
Track Mendix Studio Pro version inventory to identify hosts running versions listed in Siemens Security Advisory SSA-779310.
Monitor code repositories and shared storage for newly introduced or modified .mpr and .mpk files pending developer review.

How to Mitigate CVE-2026-48192

Immediate Actions Required

Upgrade Mendix Studio Pro 10.24 to V10.24.21 or later, and Mendix Studio Pro 11.6 to V11.6.7 or later, per Siemens guidance.
For unfixed branches (10.11–10.23, 11.0–11.5, 11.7–11.11), migrate developers to a fixed release branch as soon as an upgrade path becomes available.
Instruct developers to open only Mendix projects obtained from trusted internal sources or verified partners.
Isolate developer workstations that opened suspicious projects and review process, file, and network telemetry for signs of execution.

Patch Information

Siemens has published fixes referenced in Siemens Security Advisory SSA-779310. The advisory identifies V10.24.21 and V11.6.7 as fixed versions for their respective branches. Consult the advisory for the authoritative list of remediated versions and upgrade guidance.

Workarounds

Restrict acceptance of Mendix project files to signed, internally reviewed sources and reject externally sourced projects by policy.
Perform builds of untrusted or third-party Mendix projects only inside isolated, non-privileged sandbox environments without access to sensitive credentials or networks.
Apply application allowlisting on developer workstations to block script interpreters from executing as children of Mendix Studio Pro.

bash

# Verify installed Mendix Studio Pro version on Windows workstations
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "Mendix Studio Pro*" } |
  Select-Object DisplayName, DisplayVersion, InstallLocation