Security Arsenal is tracking a critical advisory (ICSA-26-209-02) regarding the Siemens Mendix Runtime. This is not a traditional software flaw requiring a binary patch, but a dangerous documentation gap leading to widespread logical security vulnerabilities. The issue centers on the System.User entity, a core component of the Mendix architecture.
Developers relying on current documentation may inadvertently configure overly permissive access rules. This allows unauthorized actors—specifically anonymous users—to gain read or write access to sensitive data or privilege scopes within the application. Given the widespread use of Mendix in enterprise and operational technology (OT) environments, CISOs must immediately inventory their Mendix deployments and mandate a security review of access rules.
Technical Analysis
Affected Platform: Siemens Mendix Runtime (Low-Code Development Platform) Advisory ID: ICSA-26-209-02 Issue Type: Security Misconfiguration / Documentation Gap
The Vulnerability Mechanism:
The Mendix platform utilizes an entity-based access control model. The System.User entity is a special system entity that represents user accounts. The advisory highlights that official documentation fails to adequately describe the specific behaviors and inheritance associated with this entity.
This lack of guidance leads to a common misconfiguration where developers apply access rules to System.User intended for authenticated users, but the runtime implicitly extends these permissions to the Anonymous user role. Consequently, an unauthenticated user (Anonymous) can interact with the System.User entity and potentially access all stored records in the database, bypassing intended security layers.
Exploitation Requirements:
- No Exploit Code Required: This is a logic/configuration issue. Exploitation does not require memory corruption or bypassing an authentication check in the traditional sense; it abuses the default logical inheritance of the application.
- Access: An attacker needs network access to the Mendix application endpoint (HTTP/HTTPS).
Impact:
- Data Exposure: Unauthorized access to Personally Identifiable Information (PII) or proprietary business logic stored in user entities.
- Privilege Escalation: In certain configurations, modifying
System.Userobjects could lead to account takeover or privilege elevation within the application context.
Detection & Response
Detecting this misconfiguration requires identifying active Mendix runtime instances in your environment and verifying their configuration. The following rules and queries assist in asset discovery and hunting for suspicious activity indicative of mass data retrieval via anonymous sessions.
SIGMA Rules
---
title: Potential Siemens Mendix Runtime Process Execution
id: 85d9a23-1f72-5e3a-b8c5-2d2f3b4c5d6e
status: experimental
description: Detects the execution of Mendix Runtime processes, often identified by the 'mxruntime' argument or specific service wrappers. This aids in asset discovery for identifying vulnerable deployments.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-02
author: Security Arsenal
date: 2026/04/06
tags:
- attack.discovery
- attack.t1518
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains:
- 'mxruntime'
- 'mendix'
condition: selection
falsepositives:
- Legitimate Mendix developer workstation or production server activity
level: low
---
title: Suspicious Anonymous Data Retrieval Patterns (Mendix)
id: 92e4b11-3c85-4d6a-a7d9-1a1b2c3d4e5f
status: experimental
description: Hunts for high-volume HTTP GET requests from anonymous IP ranges to Mendix application endpoints, potentially indicating exploitation of the System.User entity disclosure.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-02
author: Security Arsenal
date: 2026/04/06
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
product: apache
detection:
selection:
cs-method: 'GET'
cs-uri-query|contains:
- 'System.User'
- 'xpath='
cs-username|startswith: 'anonymous'
condition: selection
falsepositives:
- Legitimate unauthenticated public data access
level: medium
KQL (Microsoft Sentinel / Defender)
// Identify Mendix Runtime processes on Linux/Unix via Syslog
// Note: Adjust based on your Syslog ingestion format (CEF/ASIM)
Syslog
| where ProcessName contains "java"
| where SyslogMessage has "mxruntime"
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| summarize count() by Computer, bin(TimeGenerated, 1h)
| sort by count_ desc
Velociraptor VQL
-- Hunt for Mendix Runtime artifacts on disk
-- This query looks for common Mendix directory structures and configuration files
SELECT FullPath, Size, Mtime
FROM glob(globs='**/modeler/**')
WHERE FullPath =~ '.mpr'
OR FullPath =~ 'project.'
LIMIT 50
Remediation Script (PowerShell)
<#
.SYNOPSIS
Audit Windows systems for active Mendix Runtime processes.
.DESCRIPTION
This script checks for running Java processes that indicate a Mendix Runtime is active.
If found, it flags the host for immediate manual review of access rules per ICSA-26-209-02.
#>
Write-Host "Scanning for Mendix Runtime instances..." -ForegroundColor Cyan
$processes = Get-WmiObject Win32_Process | Where-Object { $_.CommandLine -like '*mxruntime*' -or $_.CommandLine -like '*mendix*' }
if ($processes) {
Write-Host "[ALERT] Mendix Runtime detected on this host." -ForegroundColor Red
foreach ($proc in $processes) {
Write-Host "Process ID: $($proc.ProcessId)"
Write-Host "CommandLine: $($proc.CommandLine)"
Write-Host "------------------------------------------------"
}
Write-Host "ACTION REQUIRED: Review the Access Rules for the System.User entity in the Mendix Studio Pro project associated with this runtime."
Write-Host "Refer to Siemens Advisory ICSA-26-209-02 for specific configuration guidance."
} else {
Write-Host "No active Mendix Runtime processes found." -ForegroundColor Green
}
Remediation
Siemens recommends that developers immediately review and update their access rules. Do not rely on default behaviors.
1. Review Access Rules in Mendix Studio Pro:
- Open your Mendix project in Mendix Studio Pro.
- Navigate to the Security pane (usually accessed via the Project Explorer).
- Locate the Module Security settings and specifically the Entity Access section.
- Find the System.User entity.
2. Verify Permissions:
- Ensure that the Anonymous user role does not have Read/Write permissions assigned to the
System.Userentity unless strictly required for public functionality. - Verify that other user roles do not have overly broad permissions on
System.Userthat could allow privilege escalation or data leakage.
3. Update Documentation:
- Siemens has updated documentation regarding the
System.Userentity. Developers must review the new guidelines to understand the special behavior of this entity compared to standard domain entities.
4. Update/Runtime Maintenance:
- Review ICSA-26-209-02 for the specific list of affected runtime versions and apply updates or configuration changes provided by Siemens.
- Note: The specific version list was not fully detailed in the summary; refer to the full CISA advisory for the complete version matrix.
Related Resources
Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.