Mendix Technology B.V. Status

Identified: The fix for Java 17 has been released and rolled out across Mendix Cloud. If your app is running on Java 17, please follow the redeploy instructions as listed in the original statuspage message. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

Identified: What happened On 20 October 2026, Oracle has released an October 2026 Critical Patch Update (https://blogs.oracle.com/security/october-2026-critical-patch-update-released) that includes multiple fixes for Java versions that are in use by Mendix apps.

Who is affected All customers with applications running on Mendix Cloud.

What we did We have updated the Java version for Java 25, Java 21 and Java 17. These new versions include the critical patch updates. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

What you need to do If your app is running on Java 17, 21 or Java 25, you should redeploy your app. You can find the Java version used for your environment on the Environment Details page (https://docs.mendix.com/developerportal/deploy/environments-details/#application-status). You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

We recommend doing this in your usual order, so you can check that your applications still work before updating production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app is running on Java 11, you should keep an eye on this Statuspage incident. We will update this when we release new Java versions on Mendix Cloud. These updates will include instructions for the specific Java versions.

Deployment requirements To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

If you have any questions, feel free to contact support.

Resolved: This incident has been resolved.

Monitoring: A fix has been implemented and we're monitoring the results.

Identified: We identified the impact to be on many more production clusters. Incident has been updated to reflect that. We're working on a fix.

Investigating: We are currently investigating errors while accessing the logs page for some environments. So far, we've identified the impact on environments running on Mendix Cloud US-East, Mendix Cloud EU and Mendix Cloud EU (Frankfurt 2).

Resolved: This incident has been resolved.

Monitoring: What happened

A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.

Who is affected

Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.

What we did

We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC.

What you need to do

The fix is added when your app is deployed, so apps that are already running only get it when you redeploy. You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.

Deployment requirements

To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

What to expect after redeploying

If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.

If you have any questions, feel free to contact support.

Identified: The fix for Java 17 has been released and rolled out across Mendix Cloud. If your app is running on Java 17, please follow the redeploy instructions as listed in the original statuspage message. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

Identified: What happened On 20 October 2026, Oracle has released an October 2026 Critical Patch Update (https://blogs.oracle.com/security/october-2026-critical-patch-update-released) that includes multiple fixes for Java versions that are in use by Mendix apps.

Who is affected All customers with applications running on Mendix Cloud.

What we did We have updated the Java version for Java 25, Java 21 and Java 17. These new versions include the critical patch updates. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

What you need to do If your app is running on Java 17, 21 or Java 25, you should redeploy your app. You can find the Java version used for your environment on the Environment Details page (https://docs.mendix.com/developerportal/deploy/environments-details/#application-status). You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

We recommend doing this in your usual order, so you can check that your applications still work before updating production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app is running on Java 11, you should keep an eye on this Statuspage incident. We will update this when we release new Java versions on Mendix Cloud. These updates will include instructions for the specific Java versions.

Deployment requirements To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

If you have any questions, feel free to contact support.

Resolved: This incident has been resolved.

Monitoring: A fix has been implemented and we're monitoring the results.

Identified: We identified the impact to be on many more production clusters. Incident has been updated to reflect that. We're working on a fix.

Investigating: We are currently investigating errors while accessing the logs page for some environments. So far, we've identified the impact on environments running on Mendix Cloud US-East, Mendix Cloud EU and Mendix Cloud EU (Frankfurt 2).

Resolved: This incident has been resolved.

Monitoring: What happened

A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.

Who is affected

Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.

What we did

We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC.

What you need to do

The fix is added when your app is deployed, so apps that are already running only get it when you redeploy. You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.

Deployment requirements

To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

What to expect after redeploying

If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.

If you have any questions, feel free to contact support.

Identified: The fix for Java 17 has been released and rolled out across Mendix Cloud. If your app is running on Java 17, please follow the redeploy instructions as listed in the original statuspage message. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

Identified: What happened On 20 October 2026, Oracle has released an October 2026 Critical Patch Update (https://blogs.oracle.com/security/october-2026-critical-patch-update-released) that includes multiple fixes for Java versions that are in use by Mendix apps.

Who is affected All customers with applications running on Mendix Cloud.

What we did We have updated the Java version for Java 25, Java 21 and Java 17. These new versions include the critical patch updates. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

What you need to do If your app is running on Java 17, 21 or Java 25, you should redeploy your app. You can find the Java version used for your environment on the Environment Details page (https://docs.mendix.com/developerportal/deploy/environments-details/#application-status). You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

We recommend doing this in your usual order, so you can check that your applications still work before updating production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app is running on Java 11, you should keep an eye on this Statuspage incident. We will update this when we release new Java versions on Mendix Cloud. These updates will include instructions for the specific Java versions.

Deployment requirements To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

If you have any questions, feel free to contact support.

Resolved: This incident has been resolved.

Monitoring: A fix has been implemented and we're monitoring the results.

Identified: We identified the impact to be on many more production clusters. Incident has been updated to reflect that. We're working on a fix.

Investigating: We are currently investigating errors while accessing the logs page for some environments. So far, we've identified the impact on environments running on Mendix Cloud US-East, Mendix Cloud EU and Mendix Cloud EU (Frankfurt 2).

Resolved: This incident has been resolved.

Monitoring: What happened

A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.

Who is affected

Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.

What we did

We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC.

What you need to do

The fix is added when your app is deployed, so apps that are already running only get it when you redeploy. You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.

Deployment requirements

To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

What to expect after redeploying

If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.

If you have any questions, feel free to contact support.

Identified: The fix for Java 17 has been released and rolled out across Mendix Cloud. If your app is running on Java 17, please follow the redeploy instructions as listed in the original statuspage message. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

Identified: What happened On 20 October 2026, Oracle has released an October 2026 Critical Patch Update (https://blogs.oracle.com/security/october-2026-critical-patch-update-released) that includes multiple fixes for Java versions that are in use by Mendix apps.

Who is affected All customers with applications running on Mendix Cloud.

What we did We have updated the Java version for Java 25, Java 21 and Java 17. These new versions include the critical patch updates. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

What you need to do If your app is running on Java 17, 21 or Java 25, you should redeploy your app. You can find the Java version used for your environment on the Environment Details page (https://docs.mendix.com/developerportal/deploy/environments-details/#application-status). You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

We recommend doing this in your usual order, so you can check that your applications still work before updating production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app is running on Java 11, you should keep an eye on this Statuspage incident. We will update this when we release new Java versions on Mendix Cloud. These updates will include instructions for the specific Java versions.

Deployment requirements To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

If you have any questions, feel free to contact support.

Resolved: This incident has been resolved.

Monitoring: What happened

A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.

Who is affected

Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.

What we did

We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC.

What you need to do

The fix is added when your app is deployed, so apps that are already running only get it when you redeploy. You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.

Deployment requirements

To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

What to expect after redeploying

If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.

If you have any questions, feel free to contact support.

Identified: The fix for Java 17 has been released and rolled out across Mendix Cloud. If your app is running on Java 17, please follow the redeploy instructions as listed in the original statuspage message. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

Identified: What happened On 20 October 2026, Oracle has released an October 2026 Critical Patch Update (https://blogs.oracle.com/security/october-2026-critical-patch-update-released) that includes multiple fixes for Java versions that are in use by Mendix apps.

Who is affected All customers with applications running on Mendix Cloud.

What we did We have updated the Java version for Java 25, Java 21 and Java 17. These new versions include the critical patch updates. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

What you need to do If your app is running on Java 17, 21 or Java 25, you should redeploy your app. You can find the Java version used for your environment on the Environment Details page (https://docs.mendix.com/developerportal/deploy/environments-details/#application-status). You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

We recommend doing this in your usual order, so you can check that your applications still work before updating production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app is running on Java 11, you should keep an eye on this Statuspage incident. We will update this when we release new Java versions on Mendix Cloud. These updates will include instructions for the specific Java versions.

Deployment requirements To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

If you have any questions, feel free to contact support.

Resolved: This incident has been resolved.

Monitoring: A fix has been implemented and we're monitoring the results.

Identified: We identified the impact to be on many more production clusters. Incident has been updated to reflect that. We're working on a fix.

Investigating: We are currently investigating errors while accessing the logs page for some environments. So far, we've identified the impact on environments running on Mendix Cloud US-East, Mendix Cloud EU and Mendix Cloud EU (Frankfurt 2).

Resolved: This incident has been resolved.

Monitoring: What happened

A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.

Who is affected

Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.

What we did

We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC.

What you need to do

The fix is added when your app is deployed, so apps that are already running only get it when you redeploy. You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.

Deployment requirements

To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

What to expect after redeploying

If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.

If you have any questions, feel free to contact support.

Identified: The fix for Java 17 has been released and rolled out across Mendix Cloud. If your app is running on Java 17, please follow the redeploy instructions as listed in the original statuspage message. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

Identified: What happened On 20 October 2026, Oracle has released an October 2026 Critical Patch Update (https://blogs.oracle.com/security/october-2026-critical-patch-update-released) that includes multiple fixes for Java versions that are in use by Mendix apps.

Who is affected All customers with applications running on Mendix Cloud.

What we did We have updated the Java version for Java 25, Java 21 and Java 17. These new versions include the critical patch updates. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

What you need to do If your app is running on Java 17, 21 or Java 25, you should redeploy your app. You can find the Java version used for your environment on the Environment Details page (https://docs.mendix.com/developerportal/deploy/environments-details/#application-status). You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

We recommend doing this in your usual order, so you can check that your applications still work before updating production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app is running on Java 11, you should keep an eye on this Statuspage incident. We will update this when we release new Java versions on Mendix Cloud. These updates will include instructions for the specific Java versions.

Deployment requirements To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

If you have any questions, feel free to contact support.

Resolved: This incident has been resolved.

Monitoring: A fix has been implemented and we're monitoring the results.

Identified: We identified the impact to be on many more production clusters. Incident has been updated to reflect that. We're working on a fix.

Investigating: We are currently investigating errors while accessing the logs page for some environments. So far, we've identified the impact on environments running on Mendix Cloud US-East, Mendix Cloud EU and Mendix Cloud EU (Frankfurt 2).

Resolved: This incident has been resolved.

Monitoring: What happened

A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.

Who is affected

Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.

What we did

We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC.

What you need to do

The fix is added when your app is deployed, so apps that are already running only get it when you redeploy. You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.

Deployment requirements

To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

What to expect after redeploying

If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.

If you have any questions, feel free to contact support.

Identified: The fix for Java 17 has been released and rolled out across Mendix Cloud. If your app is running on Java 17, please follow the redeploy instructions as listed in the original statuspage message. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

Identified: What happened On 20 October 2026, Oracle has released an October 2026 Critical Patch Update (https://blogs.oracle.com/security/october-2026-critical-patch-update-released) that includes multiple fixes for Java versions that are in use by Mendix apps.

Who is affected All customers with applications running on Mendix Cloud.

What we did We have updated the Java version for Java 25, Java 21 and Java 17. These new versions include the critical patch updates. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

What you need to do If your app is running on Java 17, 21 or Java 25, you should redeploy your app. You can find the Java version used for your environment on the Environment Details page (https://docs.mendix.com/developerportal/deploy/environments-details/#application-status). You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

We recommend doing this in your usual order, so you can check that your applications still work before updating production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app is running on Java 11, you should keep an eye on this Statuspage incident. We will update this when we release new Java versions on Mendix Cloud. These updates will include instructions for the specific Java versions.

Deployment requirements To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

If you have any questions, feel free to contact support.

Resolved: This incident has been resolved.

Monitoring: A fix has been implemented and we're monitoring the results.

Identified: We identified the impact to be on many more production clusters. Incident has been updated to reflect that. We're working on a fix.

Investigating: We are currently investigating errors while accessing the logs page for some environments. So far, we've identified the impact on environments running on Mendix Cloud US-East, Mendix Cloud EU and Mendix Cloud EU (Frankfurt 2).

Resolved: This incident has been resolved.

Monitoring: What happened

A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.

Who is affected

Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.

What we did

We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC.

What you need to do

The fix is added when your app is deployed, so apps that are already running only get it when you redeploy. You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.

Deployment requirements

To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

What to expect after redeploying

If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.

If you have any questions, feel free to contact support.

Identified: The fix for Java 17 has been released and rolled out across Mendix Cloud. If your app is running on Java 17, please follow the redeploy instructions as listed in the original statuspage message. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

Identified: What happened On 20 October 2026, Oracle has released an October 2026 Critical Patch Update (https://blogs.oracle.com/security/october-2026-critical-patch-update-released) that includes multiple fixes for Java versions that are in use by Mendix apps.

Who is affected All customers with applications running on Mendix Cloud.

What we did We have updated the Java version for Java 25, Java 21 and Java 17. These new versions include the critical patch updates. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

What you need to do If your app is running on Java 17, 21 or Java 25, you should redeploy your app. You can find the Java version used for your environment on the Environment Details page (https://docs.mendix.com/developerportal/deploy/environments-details/#application-status). You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

We recommend doing this in your usual order, so you can check that your applications still work before updating production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app is running on Java 11, you should keep an eye on this Statuspage incident. We will update this when we release new Java versions on Mendix Cloud. These updates will include instructions for the specific Java versions.

Deployment requirements To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

If you have any questions, feel free to contact support.

Resolved: This incident has been resolved.

Monitoring: A fix has been implemented and we're monitoring the results.

Identified: We identified the impact to be on many more production clusters. Incident has been updated to reflect that. We're working on a fix.

Investigating: We are currently investigating errors while accessing the logs page for some environments. So far, we've identified the impact on environments running on Mendix Cloud US-East, Mendix Cloud EU and Mendix Cloud EU (Frankfurt 2).

Resolved: This incident has been resolved.

Monitoring: What happened

A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.

Who is affected

Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.

What we did

We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC.

What you need to do

The fix is added when your app is deployed, so apps that are already running only get it when you redeploy. You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.

Deployment requirements

To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

What to expect after redeploying

If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.

If you have any questions, feel free to contact support.

Identified: The fix for Java 17 has been released and rolled out across Mendix Cloud. If your app is running on Java 17, please follow the redeploy instructions as listed in the original statuspage message. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

Identified: What happened On 20 October 2026, Oracle has released an October 2026 Critical Patch Update (https://blogs.oracle.com/security/october-2026-critical-patch-update-released) that includes multiple fixes for Java versions that are in use by Mendix apps.

Who is affected All customers with applications running on Mendix Cloud.

What we did We have updated the Java version for Java 25, Java 21 and Java 17. These new versions include the critical patch updates. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

What you need to do If your app is running on Java 17, 21 or Java 25, you should redeploy your app. You can find the Java version used for your environment on the Environment Details page (https://docs.mendix.com/developerportal/deploy/environments-details/#application-status). You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

We recommend doing this in your usual order, so you can check that your applications still work before updating production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app is running on Java 11, you should keep an eye on this Statuspage incident. We will update this when we release new Java versions on Mendix Cloud. These updates will include instructions for the specific Java versions.

Deployment requirements To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

If you have any questions, feel free to contact support.

Resolved: This incident has been resolved.

Monitoring: A fix has been implemented and we're monitoring the results.

Identified: We identified the impact to be on many more production clusters. Incident has been updated to reflect that. We're working on a fix.

Investigating: We are currently investigating errors while accessing the logs page for some environments. So far, we've identified the impact on environments running on Mendix Cloud US-East, Mendix Cloud EU and Mendix Cloud EU (Frankfurt 2).

Resolved: This incident has been resolved.

Monitoring: What happened

A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.

Who is affected

Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.

What we did

We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC.

What you need to do

The fix is added when your app is deployed, so apps that are already running only get it when you redeploy. You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.

Deployment requirements

To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

What to expect after redeploying

If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.

If you have any questions, feel free to contact support.

Identified: The fix for Java 17 has been released and rolled out across Mendix Cloud. If your app is running on Java 17, please follow the redeploy instructions as listed in the original statuspage message. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

Identified: What happened On 20 October 2026, Oracle has released an October 2026 Critical Patch Update (https://blogs.oracle.com/security/october-2026-critical-patch-update-released) that includes multiple fixes for Java versions that are in use by Mendix apps.

Who is affected All customers with applications running on Mendix Cloud.

What we did We have updated the Java version for Java 25, Java 21 and Java 17. These new versions include the critical patch updates. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

What you need to do If your app is running on Java 17, 21 or Java 25, you should redeploy your app. You can find the Java version used for your environment on the Environment Details page (https://docs.mendix.com/developerportal/deploy/environments-details/#application-status). You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

We recommend doing this in your usual order, so you can check that your applications still work before updating production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app is running on Java 11, you should keep an eye on this Statuspage incident. We will update this when we release new Java versions on Mendix Cloud. These updates will include instructions for the specific Java versions.

Deployment requirements To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

If you have any questions, feel free to contact support.

Resolved: This incident has been resolved.

Monitoring: A fix has been implemented and we're monitoring the results.

Identified: We identified the impact to be on many more production clusters. Incident has been updated to reflect that. We're working on a fix.

Investigating: We are currently investigating errors while accessing the logs page for some environments. So far, we've identified the impact on environments running on Mendix Cloud US-East, Mendix Cloud EU and Mendix Cloud EU (Frankfurt 2).

Resolved: This incident has been resolved.

Monitoring: What happened

A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.

Who is affected

Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.

What we did

We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC.

What you need to do

The fix is added when your app is deployed, so apps that are already running only get it when you redeploy. You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.

Deployment requirements

To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

What to expect after redeploying

If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.

If you have any questions, feel free to contact support.

Identified: The fix for Java 17 has been released and rolled out across Mendix Cloud. If your app is running on Java 17, please follow the redeploy instructions as listed in the original statuspage message. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

Identified: What happened On 20 October 2026, Oracle has released an October 2026 Critical Patch Update (https://blogs.oracle.com/security/october-2026-critical-patch-update-released) that includes multiple fixes for Java versions that are in use by Mendix apps.

Who is affected All customers with applications running on Mendix Cloud.

What we did We have updated the Java version for Java 25, Java 21 and Java 17. These new versions include the critical patch updates. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

What you need to do If your app is running on Java 17, 21 or Java 25, you should redeploy your app. You can find the Java version used for your environment on the Environment Details page (https://docs.mendix.com/developerportal/deploy/environments-details/#application-status). You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

We recommend doing this in your usual order, so you can check that your applications still work before updating production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app is running on Java 11, you should keep an eye on this Statuspage incident. We will update this when we release new Java versions on Mendix Cloud. These updates will include instructions for the specific Java versions.

Deployment requirements To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

If you have any questions, feel free to contact support.

Resolved: This incident has been resolved.

Monitoring: A fix has been implemented and we're monitoring the results.

Identified: We identified the impact to be on many more production clusters. Incident has been updated to reflect that. We're working on a fix.

Investigating: We are currently investigating errors while accessing the logs page for some environments. So far, we've identified the impact on environments running on Mendix Cloud US-East, Mendix Cloud EU and Mendix Cloud EU (Frankfurt 2).

Resolved: This incident has been resolved.

Monitoring: What happened

A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.

Who is affected

Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.

What we did

We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC.

What you need to do

The fix is added when your app is deployed, so apps that are already running only get it when you redeploy. You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.

Deployment requirements

To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

What to expect after redeploying

If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.

If you have any questions, feel free to contact support.

Identified: The fix for Java 17 has been released and rolled out across Mendix Cloud. If your app is running on Java 17, please follow the redeploy instructions as listed in the original statuspage message. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

Identified: What happened On 20 October 2026, Oracle has released an October 2026 Critical Patch Update (https://blogs.oracle.com/security/october-2026-critical-patch-update-released) that includes multiple fixes for Java versions that are in use by Mendix apps.

Who is affected All customers with applications running on Mendix Cloud.

What we did We have updated the Java version for Java 25, Java 21 and Java 17. These new versions include the critical patch updates. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

What you need to do If your app is running on Java 17, 21 or Java 25, you should redeploy your app. You can find the Java version used for your environment on the Environment Details page (https://docs.mendix.com/developerportal/deploy/environments-details/#application-status). You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

We recommend doing this in your usual order, so you can check that your applications still work before updating production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app is running on Java 11, you should keep an eye on this Statuspage incident. We will update this when we release new Java versions on Mendix Cloud. These updates will include instructions for the specific Java versions.

Deployment requirements To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

If you have any questions, feel free to contact support.

Resolved: This incident has been resolved.

Monitoring: A fix has been implemented and we're monitoring the results.

Identified: We identified the impact to be on many more production clusters. Incident has been updated to reflect that. We're working on a fix.

Investigating: We are currently investigating errors while accessing the logs page for some environments. So far, we've identified the impact on environments running on Mendix Cloud US-East, Mendix Cloud EU and Mendix Cloud EU (Frankfurt 2).

Resolved: This incident has been resolved.

Monitoring: What happened

A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.

Who is affected

Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.

What we did

We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC.

What you need to do

The fix is added when your app is deployed, so apps that are already running only get it when you redeploy. You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.

Deployment requirements

To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

What to expect after redeploying

If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.

If you have any questions, feel free to contact support.

Identified: The fix for Java 17 has been released and rolled out across Mendix Cloud. If your app is running on Java 17, please follow the redeploy instructions as listed in the original statuspage message. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

Identified: What happened On 20 October 2026, Oracle has released an October 2026 Critical Patch Update (https://blogs.oracle.com/security/october-2026-critical-patch-update-released) that includes multiple fixes for Java versions that are in use by Mendix apps.

Who is affected All customers with applications running on Mendix Cloud.

What we did We have updated the Java version for Java 25, Java 21 and Java 17. These new versions include the critical patch updates. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

What you need to do If your app is running on Java 17, 21 or Java 25, you should redeploy your app. You can find the Java version used for your environment on the Environment Details page (https://docs.mendix.com/developerportal/deploy/environments-details/#application-status). You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

We recommend doing this in your usual order, so you can check that your applications still work before updating production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app is running on Java 11, you should keep an eye on this Statuspage incident. We will update this when we release new Java versions on Mendix Cloud. These updates will include instructions for the specific Java versions.

Deployment requirements To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

If you have any questions, feel free to contact support.

Resolved: This incident has been resolved.

Monitoring: A fix has been implemented and we're monitoring the results.

Identified: We identified the impact to be on many more production clusters. Incident has been updated to reflect that. We're working on a fix.

Investigating: We are currently investigating errors while accessing the logs page for some environments. So far, we've identified the impact on environments running on Mendix Cloud US-East, Mendix Cloud EU and Mendix Cloud EU (Frankfurt 2).

Resolved: This incident has been resolved.

Monitoring: What happened

A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.

Who is affected

Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.

What we did

We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC.

What you need to do

The fix is added when your app is deployed, so apps that are already running only get it when you redeploy. You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.

Deployment requirements

To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

What to expect after redeploying

If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.

If you have any questions, feel free to contact support.

Identified: The fix for Java 17 has been released and rolled out across Mendix Cloud. If your app is running on Java 17, please follow the redeploy instructions as listed in the original statuspage message. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

Identified: What happened On 20 October 2026, Oracle has released an October 2026 Critical Patch Update (https://blogs.oracle.com/security/october-2026-critical-patch-update-released) that includes multiple fixes for Java versions that are in use by Mendix apps.

Who is affected All customers with applications running on Mendix Cloud.

What we did We have updated the Java version for Java 25, Java 21 and Java 17. These new versions include the critical patch updates. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

What you need to do If your app is running on Java 17, 21 or Java 25, you should redeploy your app. You can find the Java version used for your environment on the Environment Details page (https://docs.mendix.com/developerportal/deploy/environments-details/#application-status). You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

We recommend doing this in your usual order, so you can check that your applications still work before updating production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app is running on Java 11, you should keep an eye on this Statuspage incident. We will update this when we release new Java versions on Mendix Cloud. These updates will include instructions for the specific Java versions.

Deployment requirements To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

If you have any questions, feel free to contact support.

Resolved: This incident has been resolved.

Monitoring: A fix has been implemented and we're monitoring the results.

Identified: We identified the impact to be on many more production clusters. Incident has been updated to reflect that. We're working on a fix.

Investigating: We are currently investigating errors while accessing the logs page for some environments. So far, we've identified the impact on environments running on Mendix Cloud US-East, Mendix Cloud EU and Mendix Cloud EU (Frankfurt 2).

Resolved: This incident has been resolved.

Monitoring: What happened

A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.

Who is affected

Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.

What we did

We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC.

What you need to do

The fix is added when your app is deployed, so apps that are already running only get it when you redeploy. You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.

Deployment requirements

To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

What to expect after redeploying

If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.

If you have any questions, feel free to contact support.

Identified: The fix for Java 17 has been released and rolled out across Mendix Cloud. If your app is running on Java 17, please follow the redeploy instructions as listed in the original statuspage message. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

Identified: What happened On 20 October 2026, Oracle has released an October 2026 Critical Patch Update (https://blogs.oracle.com/security/october-2026-critical-patch-update-released) that includes multiple fixes for Java versions that are in use by Mendix apps.

Who is affected All customers with applications running on Mendix Cloud.

What we did We have updated the Java version for Java 25, Java 21 and Java 17. These new versions include the critical patch updates. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

What you need to do If your app is running on Java 17, 21 or Java 25, you should redeploy your app. You can find the Java version used for your environment on the Environment Details page (https://docs.mendix.com/developerportal/deploy/environments-details/#application-status). You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

We recommend doing this in your usual order, so you can check that your applications still work before updating production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app is running on Java 11, you should keep an eye on this Statuspage incident. We will update this when we release new Java versions on Mendix Cloud. These updates will include instructions for the specific Java versions.

Deployment requirements To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

If you have any questions, feel free to contact support.

Resolved: This incident has been resolved.

Monitoring: A fix has been implemented and we're monitoring the results.

Identified: We identified the impact to be on many more production clusters. Incident has been updated to reflect that. We're working on a fix.

Investigating: We are currently investigating errors while accessing the logs page for some environments. So far, we've identified the impact on environments running on Mendix Cloud US-East, Mendix Cloud EU and Mendix Cloud EU (Frankfurt 2).

Resolved: This incident has been resolved.

Monitoring: What happened

A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.

Who is affected

Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.

What we did

We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC.

What you need to do

The fix is added when your app is deployed, so apps that are already running only get it when you redeploy. You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.

Deployment requirements

To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

What to expect after redeploying

If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.

If you have any questions, feel free to contact support.

Identified: The fix for Java 17 has been released and rolled out across Mendix Cloud. If your app is running on Java 17, please follow the redeploy instructions as listed in the original statuspage message. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

Identified: What happened On 20 October 2026, Oracle has released an October 2026 Critical Patch Update (https://blogs.oracle.com/security/october-2026-critical-patch-update-released) that includes multiple fixes for Java versions that are in use by Mendix apps.

Who is affected All customers with applications running on Mendix Cloud.

What we did We have updated the Java version for Java 25, Java 21 and Java 17. These new versions include the critical patch updates. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

What you need to do If your app is running on Java 17, 21 or Java 25, you should redeploy your app. You can find the Java version used for your environment on the Environment Details page (https://docs.mendix.com/developerportal/deploy/environments-details/#application-status). You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

We recommend doing this in your usual order, so you can check that your applications still work before updating production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app is running on Java 11, you should keep an eye on this Statuspage incident. We will update this when we release new Java versions on Mendix Cloud. These updates will include instructions for the specific Java versions.

Deployment requirements To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

If you have any questions, feel free to contact support.

Resolved: This incident has been resolved.

Monitoring: A fix has been implemented and we're monitoring the results.

Identified: We identified the impact to be on many more production clusters. Incident has been updated to reflect that. We're working on a fix.

Investigating: We are currently investigating errors while accessing the logs page for some environments. So far, we've identified the impact on environments running on Mendix Cloud US-East, Mendix Cloud EU and Mendix Cloud EU (Frankfurt 2).

Resolved: This incident has been resolved.

Monitoring: What happened

A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.

Who is affected

Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.

What we did

We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC.

What you need to do

The fix is added when your app is deployed, so apps that are already running only get it when you redeploy. You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.

Deployment requirements

To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

What to expect after redeploying

If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.

If you have any questions, feel free to contact support.

Identified: The fix for Java 17 has been released and rolled out across Mendix Cloud. If your app is running on Java 17, please follow the redeploy instructions as listed in the original statuspage message. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

Identified: What happened On 20 October 2026, Oracle has released an October 2026 Critical Patch Update (https://blogs.oracle.com/security/october-2026-critical-patch-update-released) that includes multiple fixes for Java versions that are in use by Mendix apps.

Who is affected All customers with applications running on Mendix Cloud.

What we did We have updated the Java version for Java 25, Java 21 and Java 17. These new versions include the critical patch updates. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

What you need to do If your app is running on Java 17, 21 or Java 25, you should redeploy your app. You can find the Java version used for your environment on the Environment Details page (https://docs.mendix.com/developerportal/deploy/environments-details/#application-status). You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

We recommend doing this in your usual order, so you can check that your applications still work before updating production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app is running on Java 11, you should keep an eye on this Statuspage incident. We will update this when we release new Java versions on Mendix Cloud. These updates will include instructions for the specific Java versions.

Deployment requirements To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

If you have any questions, feel free to contact support.

Resolved: This incident has been resolved.

Monitoring: A fix has been implemented and we're monitoring the results.

Identified: We identified the impact to be on many more production clusters. Incident has been updated to reflect that. We're working on a fix.

Investigating: We are currently investigating errors while accessing the logs page for some environments. So far, we've identified the impact on environments running on Mendix Cloud US-East, Mendix Cloud EU and Mendix Cloud EU (Frankfurt 2).

Resolved: This incident has been resolved.

Monitoring: What happened

A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.

Who is affected

Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.

What we did

We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC.

What you need to do

The fix is added when your app is deployed, so apps that are already running only get it when you redeploy. You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.

Deployment requirements

To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

What to expect after redeploying

If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.

If you have any questions, feel free to contact support.

Identified: The fix for Java 17 has been released and rolled out across Mendix Cloud. If your app is running on Java 17, please follow the redeploy instructions as listed in the original statuspage message. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

Identified: What happened On 20 October 2026, Oracle has released an October 2026 Critical Patch Update (https://blogs.oracle.com/security/october-2026-critical-patch-update-released) that includes multiple fixes for Java versions that are in use by Mendix apps.

Who is affected All customers with applications running on Mendix Cloud.

What we did We have updated the Java version for Java 25, Java 21 and Java 17. These new versions include the critical patch updates. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

What you need to do If your app is running on Java 17, 21 or Java 25, you should redeploy your app. You can find the Java version used for your environment on the Environment Details page (https://docs.mendix.com/developerportal/deploy/environments-details/#application-status). You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

We recommend doing this in your usual order, so you can check that your applications still work before updating production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app is running on Java 11, you should keep an eye on this Statuspage incident. We will update this when we release new Java versions on Mendix Cloud. These updates will include instructions for the specific Java versions.

Deployment requirements To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

If you have any questions, feel free to contact support.

Resolved: This incident has been resolved.

Monitoring: What happened

A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.

Who is affected

Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.

What we did

We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC.

What you need to do

The fix is added when your app is deployed, so apps that are already running only get it when you redeploy. You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.

Deployment requirements

To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

What to expect after redeploying

If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.

If you have any questions, feel free to contact support.

Identified: The fix for Java 17 has been released and rolled out across Mendix Cloud. If your app is running on Java 17, please follow the redeploy instructions as listed in the original statuspage message. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

Identified: What happened On 20 October 2026, Oracle has released an October 2026 Critical Patch Update (https://blogs.oracle.com/security/october-2026-critical-patch-update-released) that includes multiple fixes for Java versions that are in use by Mendix apps.

Who is affected All customers with applications running on Mendix Cloud.

What we did We have updated the Java version for Java 25, Java 21 and Java 17. These new versions include the critical patch updates. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

What you need to do If your app is running on Java 17, 21 or Java 25, you should redeploy your app. You can find the Java version used for your environment on the Environment Details page (https://docs.mendix.com/developerportal/deploy/environments-details/#application-status). You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

We recommend doing this in your usual order, so you can check that your applications still work before updating production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app is running on Java 11, you should keep an eye on this Statuspage incident. We will update this when we release new Java versions on Mendix Cloud. These updates will include instructions for the specific Java versions.

Deployment requirements To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

If you have any questions, feel free to contact support.

Resolved: This incident has been resolved.

Monitoring: What happened

A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.

Who is affected

Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.

What we did

We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC.

What you need to do

The fix is added when your app is deployed, so apps that are already running only get it when you redeploy. You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.

Deployment requirements

To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

What to expect after redeploying

If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.

If you have any questions, feel free to contact support.

Identified: The fix for Java 17 has been released and rolled out across Mendix Cloud. If your app is running on Java 17, please follow the redeploy instructions as listed in the original statuspage message. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

Identified: What happened On 20 October 2026, Oracle has released an October 2026 Critical Patch Update (https://blogs.oracle.com/security/october-2026-critical-patch-update-released) that includes multiple fixes for Java versions that are in use by Mendix apps.

Who is affected All customers with applications running on Mendix Cloud.

What we did We have updated the Java version for Java 25, Java 21 and Java 17. These new versions include the critical patch updates. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

What you need to do If your app is running on Java 17, 21 or Java 25, you should redeploy your app. You can find the Java version used for your environment on the Environment Details page (https://docs.mendix.com/developerportal/deploy/environments-details/#application-status). You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

We recommend doing this in your usual order, so you can check that your applications still work before updating production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app is running on Java 11, you should keep an eye on this Statuspage incident. We will update this when we release new Java versions on Mendix Cloud. These updates will include instructions for the specific Java versions.

Deployment requirements To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

If you have any questions, feel free to contact support.

Resolved: This incident has been resolved.

Monitoring: A fix has been implemented and we're monitoring the results.

Identified: We identified the impact to be on many more production clusters. Incident has been updated to reflect that. We're working on a fix.

Investigating: We are currently investigating errors while accessing the logs page for some environments. So far, we've identified the impact on environments running on Mendix Cloud US-East, Mendix Cloud EU and Mendix Cloud EU (Frankfurt 2).

Resolved: This incident has been resolved.

Monitoring: What happened

A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.

Who is affected

Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.

What we did

We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC.

What you need to do

The fix is added when your app is deployed, so apps that are already running only get it when you redeploy. You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.

Deployment requirements

To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

What to expect after redeploying

If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.

If you have any questions, feel free to contact support.

Identified: The fix for Java 17 has been released and rolled out across Mendix Cloud. If your app is running on Java 17, please follow the redeploy instructions as listed in the original statuspage message. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

Identified: What happened On 20 October 2026, Oracle has released an October 2026 Critical Patch Update (https://blogs.oracle.com/security/october-2026-critical-patch-update-released) that includes multiple fixes for Java versions that are in use by Mendix apps.

Who is affected All customers with applications running on Mendix Cloud.

What we did We have updated the Java version for Java 25, Java 21 and Java 17. These new versions include the critical patch updates. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

What you need to do If your app is running on Java 17, 21 or Java 25, you should redeploy your app. You can find the Java version used for your environment on the Environment Details page (https://docs.mendix.com/developerportal/deploy/environments-details/#application-status). You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

We recommend doing this in your usual order, so you can check that your applications still work before updating production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app is running on Java 11, you should keep an eye on this Statuspage incident. We will update this when we release new Java versions on Mendix Cloud. These updates will include instructions for the specific Java versions.

Deployment requirements To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

If you have any questions, feel free to contact support.

Resolved: This incident has been resolved.

Monitoring: A fix has been implemented and we're monitoring the results.

Identified: We identified the impact to be on many more production clusters. Incident has been updated to reflect that. We're working on a fix.

Investigating: We are currently investigating errors while accessing the logs page for some environments. So far, we've identified the impact on environments running on Mendix Cloud US-East, Mendix Cloud EU and Mendix Cloud EU (Frankfurt 2).

Resolved: This incident has been resolved.

Monitoring: What happened

A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.

Who is affected

Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.

What we did

We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC.

What you need to do

The fix is added when your app is deployed, so apps that are already running only get it when you redeploy. You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.

Deployment requirements

To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

What to expect after redeploying

If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.

If you have any questions, feel free to contact support.

Identified: The fix for Java 17 has been released and rolled out across Mendix Cloud. If your app is running on Java 17, please follow the redeploy instructions as listed in the original statuspage message. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

Identified: What happened On 20 October 2026, Oracle has released an October 2026 Critical Patch Update (https://blogs.oracle.com/security/october-2026-critical-patch-update-released) that includes multiple fixes for Java versions that are in use by Mendix apps.

Who is affected All customers with applications running on Mendix Cloud.

What we did We have updated the Java version for Java 25, Java 21 and Java 17. These new versions include the critical patch updates. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

What you need to do If your app is running on Java 17, 21 or Java 25, you should redeploy your app. You can find the Java version used for your environment on the Environment Details page (https://docs.mendix.com/developerportal/deploy/environments-details/#application-status). You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

We recommend doing this in your usual order, so you can check that your applications still work before updating production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app is running on Java 11, you should keep an eye on this Statuspage incident. We will update this when we release new Java versions on Mendix Cloud. These updates will include instructions for the specific Java versions.

Deployment requirements To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

If you have any questions, feel free to contact support.

Resolved: This incident has been resolved.

Monitoring: A fix has been implemented and we're monitoring the results.

Identified: We identified the impact to be on many more production clusters. Incident has been updated to reflect that. We're working on a fix.

Investigating: We are currently investigating errors while accessing the logs page for some environments. So far, we've identified the impact on environments running on Mendix Cloud US-East, Mendix Cloud EU and Mendix Cloud EU (Frankfurt 2).

Resolved: This incident has been resolved.

Monitoring: What happened

A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.

Who is affected

Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.

What we did

We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC.

What you need to do

The fix is added when your app is deployed, so apps that are already running only get it when you redeploy. You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.

Deployment requirements

To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

What to expect after redeploying

If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.

If you have any questions, feel free to contact support.

Identified: The fix for Java 17 has been released and rolled out across Mendix Cloud. If your app is running on Java 17, please follow the redeploy instructions as listed in the original statuspage message. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

Identified: What happened On 20 October 2026, Oracle has released an October 2026 Critical Patch Update (https://blogs.oracle.com/security/october-2026-critical-patch-update-released) that includes multiple fixes for Java versions that are in use by Mendix apps.

Who is affected All customers with applications running on Mendix Cloud.

What we did We have updated the Java version for Java 25, Java 21 and Java 17. These new versions include the critical patch updates. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

What you need to do If your app is running on Java 17, 21 or Java 25, you should redeploy your app. You can find the Java version used for your environment on the Environment Details page (https://docs.mendix.com/developerportal/deploy/environments-details/#application-status). You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

We recommend doing this in your usual order, so you can check that your applications still work before updating production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app is running on Java 11, you should keep an eye on this Statuspage incident. We will update this when we release new Java versions on Mendix Cloud. These updates will include instructions for the specific Java versions.

Deployment requirements To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

If you have any questions, feel free to contact support.

Resolved: This incident has been resolved.

Monitoring: A fix has been implemented and we're monitoring the results.

Identified: We identified the impact to be on many more production clusters. Incident has been updated to reflect that. We're working on a fix.

Investigating: We are currently investigating errors while accessing the logs page for some environments. So far, we've identified the impact on environments running on Mendix Cloud US-East, Mendix Cloud EU and Mendix Cloud EU (Frankfurt 2).

Resolved: This incident has been resolved.

Monitoring: What happened

A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.

Who is affected

Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.

What we did

We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC.

What you need to do

The fix is added when your app is deployed, so apps that are already running only get it when you redeploy. You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.

Deployment requirements

To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

What to expect after redeploying

If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.

If you have any questions, feel free to contact support.

Identified: The fix for Java 17 has been released and rolled out across Mendix Cloud. If your app is running on Java 17, please follow the redeploy instructions as listed in the original statuspage message. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

Identified: What happened On 20 October 2026, Oracle has released an October 2026 Critical Patch Update (https://blogs.oracle.com/security/october-2026-critical-patch-update-released) that includes multiple fixes for Java versions that are in use by Mendix apps.

Who is affected All customers with applications running on Mendix Cloud.

What we did We have updated the Java version for Java 25, Java 21 and Java 17. These new versions include the critical patch updates. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

What you need to do If your app is running on Java 17, 21 or Java 25, you should redeploy your app. You can find the Java version used for your environment on the Environment Details page (https://docs.mendix.com/developerportal/deploy/environments-details/#application-status). You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

We recommend doing this in your usual order, so you can check that your applications still work before updating production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app is running on Java 11, you should keep an eye on this Statuspage incident. We will update this when we release new Java versions on Mendix Cloud. These updates will include instructions for the specific Java versions.

Deployment requirements To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

If you have any questions, feel free to contact support.

Resolved: This incident has been resolved.

Monitoring: A fix has been implemented and we're monitoring the results.

Identified: We identified the impact to be on many more production clusters. Incident has been updated to reflect that. We're working on a fix.

Investigating: We are currently investigating errors while accessing the logs page for some environments. So far, we've identified the impact on environments running on Mendix Cloud US-East, Mendix Cloud EU and Mendix Cloud EU (Frankfurt 2).

Resolved: This incident has been resolved.

Monitoring: What happened

A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling.

Who is affected

Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected.

What we did

We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC.

What you need to do

The fix is added when your app is deployed, so apps that are already running only get it when you redeploy. You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment.

Deployment requirements

To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

What to expect after redeploying

If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate.

If you have any questions, feel free to contact support.

Identified: The fix for Java 17 has been released and rolled out across Mendix Cloud. If your app is running on Java 17, please follow the redeploy instructions as listed in the original statuspage message. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

Identified: What happened On 20 October 2026, Oracle has released an October 2026 Critical Patch Update (https://blogs.oracle.com/security/october-2026-critical-patch-update-released) that includes multiple fixes for Java versions that are in use by Mendix apps.

Who is affected All customers with applications running on Mendix Cloud.

What we did We have updated the Java version for Java 25, Java 21 and Java 17. These new versions include the critical patch updates. For Java 11, we're waiting for an update from our vendors. Once these updates are available, we will update the Java versions used on Mendix Cloud.

What you need to do If your app is running on Java 17, 21 or Java 25, you should redeploy your app. You can find the Java version used for your environment on the Environment Details page (https://docs.mendix.com/developerportal/deploy/environments-details/#application-status). You can redeploy the same package that is already running on your environment, or build and deploy a new package. A restart is not enough!

We recommend doing this in your usual order, so you can check that your applications still work before updating production:

1. Test environment
2. Acceptance environment
3. Production environment

If your app is running on Java 11, you should keep an eye on this Statuspage incident. We will update this when we release new Java versions on Mendix Cloud. These updates will include instructions for the specific Java versions.

Deployment requirements To apply these security fixes, you must perform a regular deployment (non-Zero Downtime Deployment). Zero Downtime Deployment (ZDT) will not apply these security fixes, even when redeploying an existing deployment package. You do not need to create a new deployment package. You can redeploy your existing package using the regular deployment process. If you have already performed a Zero Downtime Deployment to apply these fixes, please redeploy using the regular deployment process. A regular deployment causes a short period of downtime while the application restarts, so please plan accordingly.

If you have any questions, feel free to contact support.

Resolved: This incident has been resolved.

Monitoring: A fix has been implemented and we're monitoring the results.

Identified: We identified the impact to be on many more production clusters. Incident has been updated to reflect that. We're working on a fix.

Investigating: We are currently investigating errors while accessing the logs page for some environments. So far, we've identified the impact on environments running on Mendix Cloud US-East, Mendix Cloud EU and Mendix Cloud EU (Frankfurt 2).

Resolved: This incident has been resolved.