DLL Search-Path Hijacking in Siemens Software Center
CISA: Siemens Software Center Uncontrolled Search Path Element Vulnerability
Siemens Software Center, in all versions, loads dynamic-link libraries from an uncontrolled search path (CWE-427). An authenticated local attacker who already has high privileges can place a crafted DLL in a directory the application searches, so the program loads that library. Successful exploitation runs arbitrary code with the privileges of Siemens Software Center and can fully compromise confidentiality, integrity, and availability on that system. The issue is local only: it requires high privileges, no user interaction, and does not extend impact to other systems under the published CVSS 4.0 score of 8.4. It is not listed in CISA KEV, and no public proof-of-concept is known.
What to do: Treat every installed copy of Siemens Software Center as affected until Siemens publishes a fixed build, and apply that update as soon as it is available. Until then, limit who can write to directories the application searches for DLLs, run the software only with the least privilege required, and review local accounts that already have high privileges on engineering workstations.
| Siemens Software Center | All versions |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.
View CSAF Summary The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application. Siemens has released a new version for Siemens Software Center and…
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that attackers are actively exploiting four vulnerabilities in Plex Media Server. The security issues are collectively called Plex2Shell. When chained in an exploit, an attacker can obtain the owner's admin token and execute code with elevated privileges. Plex Media Server is a popular media suite that helps users…
Ravie Lakshmanan Oct 21, 2026 Vulnerability / Malware The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four vulnerabilities to its Known Exploited Vulnerabilities ( KEV ) catalog, including four vulnerabilities impacting Plex Media Server that's collectively called Plex2Shell . The vulnerabilities are listed below - CVE-2026-96652 (CVSS score: 5.3) - Plex…
CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-96652 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability CVE-2026-96654 Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability CVE-2026-96655 Plex Media Server Server-Side Request Forgery (SSRF)…
Siemens revealed on Monday that threat actors have exploited a vulnerability in Siemens Software Center as part of a malware campaign. Siemens Software Center handles the download, installation, activation and updating of software that customers have bought, and it can also be used to start free trials. The vulnerability, tracked as CVE-2026-110936 , exists because the program doesn’t properly…
Serial Number: AV26-1063 Date: October 19, 2026 As of October 15, 2026, Siemens is affected by a vulnerability in the following product: Siemens Software Center Prior to V4.0.9.8 Siemens has reported that CVE-2026-110936 is being exploited in the wild. The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.…
Siemens has confirmed the active exploitation of CVE-2026-110936, a DLL side-loading vulnerability in Siemens Software Center, the company’s tool for downloading, installing and managing its software. Siemens first published its security advisory on 15 October 2026, giving the flaw reported by Jose Oregon from Huntress Labs a CVSS v4.0 score of 8.4. On 17 October, it updated the advisory to tell…
Ravie Lakshmanan Oct 20, 2026 Vulnerability / Endpoint Security Siemens has addressed a DLL sideloading vulnerability impacting Siemens Software Center that it said has been exploited in ClickFix attacks. The high-severity vulnerability, tracked as CVE-2026-110936 (CVSS v4 score: 8.4), could allow an attacker to place a specially-crafted DLL in a directory the application searches, resulting…
Siemens has confirmed that the CVE-2026-110936 vulnerability, a DLL side-loading flaw in Siemens Software Center, is being actively exploited. Attackers are using this vulnerability to execute malicious code through a legitimate, digitally signed application. Siemens published advisory SSA-580366 on October 15 and has addressed the issue in version 4.0.9.8. According to the campaign report ,…
Hackers are exploiting a DLL side-loading flaw in Siemens Software Center to run malware through a trusted, signed application. Tracked as CVE-2026-110936, the weakness affects versions before 4.0.9.8. Siemens has confirmed active exploitation and released a fix, and existing installations will receive the update the next time the application starts. Siemens published security advisory SSA-580366…
Siemens has warned customers that attackers are actively exploiting a dynamic link library (DLL) side-loading vulnerability in its Software Center to distribute malware. The company has attributed the activity to the Romulus multi-platform ClickFix campaign. Romulus is a server hosting panel that was identified by Forescout researchers on October 14. The panel allows cybercriminals to deploy…