Siemens Software Center DLL Flaw Exploited (CVE-2026-110936)

At a glance

Severity	HIGH
CVSS	CVE-2026-110936: 8.4
EPSS (30-day exploit probability)	CVE-2026-110936: 0.2%
In CISA KEV (exploited)	Yes, due 2026-11-03
Vendor	Siemens
CVE IDs	CVE-2026-110936

CISA has added a Siemens Software Center DLL search-path flaw, CVE-2026-110936, to its Known Exploited Vulnerabilities (KEV) catalog on 2026-10-20, confirming active exploitation. Versions of Siemens Software Center before V4.0.9.8 are affected, and federal agencies must apply mitigations by 2026-11-03.

The bug lets an authenticated local attacker run arbitrary code with the privileges of the application. Siemens has published an advisory and a separate note about active exploitation of this flaw.

What happened with the Siemens Software Center vulnerability

NVD describes CVE-2026-110936 as an uncontrolled search path element (CWE-427). The application loads dynamic-link libraries (DLLs) from a location an attacker can influence. If a crafted DLL is placed in a directory the application searches, the application loads it and runs the attacker’s code.

CISA named the entry “Siemens Software Center Uncontrolled Search Path Element Vulnerability” and added it on 2026-10-20. NVD published the record on 2026-10-15. Siemens’ product security team has posted a news item on active exploitation of the flaw, which is listed among the NVD references.

Am I affected?

Per NVD, the affected range is:

Siemens Software Center, all versions earlier than V4.0.9.8.

Anything at or above V4.0.9.8 is outside the range listed. Details of how attackers are exploiting the bug, who is being targeted and which other builds might be involved have not been disclosed in the sources we reviewed. CISA lists known ransomware campaign use as Unknown.

Technical details

Weakness: CWE-427, uncontrolled search path element.
Severity: CVSS 8.4 (High) under CVSS 4.0. The vector is local attack, low complexity, no user interaction, with high privileges required and high impact on confidentiality, integrity and availability.
Exploitation: confirmed. The CVE is in CISA KEV, added 2026-10-20, with a due date of 2026-11-03.
EPSS: 0.00238, a low modelled probability. Treat this as secondary to the confirmed exploitation, since EPSS is a prediction and KEV is evidence.

The scoring has a wrinkle worth noting. The vector requires high privileges and local access, which argues for a contained blast radius, yet the flaw is being exploited. That combination usually means attackers use it after they already have a foothold, for example to run code under a more privileged context or to persist.

Why this matters

This section is our analysis, not new reported facts. A local, authenticated flaw is rarely the first step of an intrusion, so it is easy to rank below remotely exploitable bugs. Exploitation in the wild changes that. Engineering workstations and build or design servers that run Siemens software often hold valuable intellectual property, and a DLL planted by a prior compromise can turn limited access into code execution under the application’s account.

Because the flaw is in KEV, a sensible target is to patch within days rather than the next monthly cycle, and sooner on systems that other users or contractors can log in to.

How to detect exploitation of CVE-2026-110936

The sources give no indicators of compromise, so there are no hashes, file names or addresses to share. Detection ideas that follow from the bug class:

Look for DLL files that were recently created or modified in the Software Center install directory and in any folder the application searches before system paths.
Review image-load events for the Software Center process loading unsigned or unexpected DLLs.
Check for new child processes launched by the Software Center process, and for write access to its directories by accounts that have no reason to modify them.
CISA’s required action refers to its “Forensics Triage Requirements”, so preserve evidence before you clean up a suspect host.

What to do

Find it. Inventory every host with Siemens Software Center and record the installed version.
Update. Move affected installs to V4.0.9.8 or later, following the Siemens advisory SSA-580366. Where you cannot update yet, apply the vendor’s mitigations.
Restrict write access. Make sure standard users cannot write to the application directory or to other locations on its DLL search path.
Hunt. Run the checks above on systems that were running a vulnerable version since the flaw was published on 2026-10-15.
Meet the deadline. CISA’s due date is 2026-11-03 for US federal agencies. CISA says to follow BOD 26-04 guidance, or to discontinue use of the product if mitigations are unavailable. Other organisations should use the same date as a practical benchmark.

Related coverage

Sources

Spotted an error or outdated detail? Email contact@cyberstrikenews.com with the article link. We correct and note every change. Read our Editorial Policy.