Paper/Archive/CVE-2026-112136

CVE-2026-112136

Siemens Mendix Studio Pro 11 — A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro 11.12 (All versions…

CVSS 9.2

critical.is priorityof 100

CVSS 9.2 (CNA)9.2 / 10 × 3027.6 Not in CISA KEV+300.0 No EPSS score.000 × 200.0 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro 11.12 (All versions >= V11.12.6 < V11.12.7). The affected products MCP Server does not properly restrict its HTTP listener to the loopback interface, leaving it potentially exposed to remote systems. This could allow an attacker with network access to interact with the MCP Server remotely.

Affected

ProductAffectedFixed inSource

Mendix Studio Pro 11V11.15.0 – < V11.16.0V11.16.0CNA

Mendix Studio Pro 11.12V11.12.6 – < V11.12.7V11.12.7CNA

Scores by source

siemens (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

siemens (CNA)8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

refcert-portal.siemens.com/productcert/html/ssa-710379.html