CVE-2024-39888: Siemens Mendix Encryption

High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days.

A vulnerability has been identified in Mendix Encryption (All versions >= V10.0.0 < V10.0.2). Affected versions of the module define a specific hard-coded default value for the EncryptionKey constant, which is used in projects where no individual EncryptionKey was specified. This could allow to an attacker to decrypt any encrypted project data, as the default encryption key can be considered compromised.

Affected products

• Siemens Mendix Encryption: from V10.0.0, before V10.0.2 (fixed in V10.0.2)

Published 2024-07-09. Last modified 2026-06-17.