CISA says Siemens Mendix Runtime advisory is revoked

The correction changes the decision

CISA’s revision history records a September 24, 2026 update revoking its Siemens Mendix Runtime advisory after Siemens revoked its corresponding advisory and CVE-2026-7891 was rejected. The history also records a revocation entry on September 22. Those entries establish a correction to an existing security report: the September 24 update documents the reversal, rather than announcing a newly discovered vulnerability.

According to CISA, reinvestigation found that the reported behavior was expected platform configuration and did not expose the protected application-specific attribute. For teams assessing this report, that finding changes the premise of the security concern. Its scope remains specific: the conclusion addresses the reported behavior and protected attribute, so it does not establish the security of every application or configuration.

Read the status alongside the retained fields

CISA’s detailed product entry marks Siemens Mendix Runtime as not affected and uses an all-versions designation. Yet the page also retains an affected-versions statement and critical severity metrics alongside the retraction. This creates a substantive reading hazard: extracting an affected-product field or severity label alone would omit the correction that changes how this particular report should inform a security assessment.

The practical implication is to distinguish the corrected finding from the defensive advice still present on the page. CISA continues to recommend minimizing control-system network exposure and preventing direct internet accessibility. Those recommendations describe defensive measures, but their presence does not establish that the rejected Mendix report still identifies an exploitable flaw. The revocation supplies the relevant status for that question.

Defensive changes still need assessment

CISA also tells organizations to conduct impact analysis and risk assessment before deploying defensive measures. For readers considering changes in response to the retained recommendations, that qualification matters: the guidance calls for an assessment before implementation. The useful decision is therefore to reconcile the corrected advisory status with any proposed defensive action, then evaluate that action’s impact instead of treating the page’s recommendations as an automatic deployment instruction.