CVE-2026-112136 A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro 11.12 (All versions >= V11.12.6 < V11.12.7). The affected products MCP Server does....

CriticalCVSS 9.2

Published: 2026-11-10 13:30
Updated: 2026-11-10 18:34
Exploit status: No public exploit known

Description

A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro 11.12 (All versions >= V11.12.6 < V11.12.7). The affected products MCP Server does not properly restrict its HTTP listener to the loopback interface, leaving it potentially exposed to remote systems. This could allow an attacker with network access to interact with the MCP Server remotely.

Affected products

Product	Affected versions	Fixed in
Siemens Mendix Studio Pro 11	>= V11.15.0, < V11.16.0	V11.16.0
Siemens Mendix Studio Pro 11.12	>= V11.12.6, < V11.12.7	V11.12.7

References

cert-portal.siemens.com

CVSS v4.0

9.2 Critical

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: Present
Privileges Required: None
User Interaction: None
Vulnerable System Confidentiality: High
Vulnerable System Integrity: High
Vulnerable System Availability: High
Subsequent System Confidentiality: None
Subsequent System Integrity: None
Subsequent System Availability: None

All scores (2)

v4.0 9.2 · siemens
v3.1 8.8 · siemens

Weakness & likelihood

EPSS (exploitation probability, 30 days): Not available
CWE: CWE-1327 Binding to an Unrestricted IP Address

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.