CVE-2026-110936 A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allo...
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.
CISA Known Exploited Vulnerability
- Date added
- 2026-10-20
- Due date (FCEB)
- 2026-11-03
- Ransomware use
- Unknown
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Siemens Software Center | < V4.0.9.8 | V4.0.9.8 |
| Siemens software center | < 4.0.9.8 | 4.0.9.8 |
References
- cert-portal.siemens.com patch vendor-advisory
- productcert.siemens.com patch third-party-advisory vendor-advisory
- www.cisa.gov government-resource us-government-resource