What’s Vulnerable › Vulnerabilities
CVE-2026-110936: Siemens Software Center Uncontrolled Search Path Element Vulnerability
- Severity: medium (CVSS 6.7 v3.1)
- Exploited in the wild: yes — in CISA KEV since 2026-10-20
- EPSS: 1.0% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-15 · updated 2026-10-21
- Weakness: CWE-427
Description
A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.
Summary
Siemens Software Center versions before V4.0.9.8 load DLLs from an uncontrolled search path, allowing an authenticated local attacker to plant a malicious DLL and execute arbitrary code with the application's privileges. The flaw is rated CVSS 6.7 (medium) and affects all versions below V4.0.9.8. CISA lists it in the Known Exploited Vulnerabilities catalog with active exploitation, though EPSS estimates only a 1.0% chance of exploitation in 30 days. Update to V4.0.9.8 or later, and follow CISA BOD 26-04 mitigation and triage guidance where patching is not immediately possible.
تُحمّل إصدارات Siemens Software Center الأقدم من V4.0.9.8 مكتبات DLL من مسار بحث غير خاضع للرقابة، ما يتيح لمهاجم محلي مُصادَق وضع مكتبة DLL خبيثة وتنفيذ تعليمات برمجية عشوائية بصلاحيات التطبيق. الثغرة مصنّفة بدرجة 6.7 (متوسطة) وتؤثر في جميع الإصدارات الأقدم من V4.0.9.8. أدرجتها CISA في كتالوج الثغرات المعروفة بالاستغلال مع استغلال نشط، رغم أن تقدير EPSS لاحتمال الاستغلال خلال 30 يوماً لا يتجاوز 1.0%. يُنصح بالترقية إلى V4.0.9.8 أو أحدث، وباتباع إرشادات التخفيف والفرز في CISA BOD 26-04 عند تعذّر الترقية الفورية.
Affected products
- Siemens Software Center: before 4.0.9.8 — fixed in 4.0.9.8
How to fix
Upgrade to a fixed version: Siemens Software Center 4.0.9.8. Check the vendor advisory for mitigations.
References
- https://cert-portal.siemens.com/productcert/html/ssa-580366.html
- https://productcert.siemens.com/news/2026/10/19/active-exploitation-of-cve-2026-110936-in-siemens-software-center/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-110936
Get alerted when CVE-2026-110936 or the next vulnerability affects your stack