CISA lists Siemens Software Center DLL path flaw as exploited
Original title: CISA KEV: Siemens Software Center Uncontrolled Search Path Element Vulnerability — Siemens Software Center (CVE-2026-110936)
Authenticated local attackers can plant a DLL for code execution; the federal action due date is November 3, 2026.
CISA added CVE-2026-110936, an uncontrolled search path flaw in Siemens Software Center versions below V4.0.9.8, to the Known Exploited Vulnerabilities catalog. The application loads DLLs from an uncontrolled path, so an authenticated local attacker can place a crafted DLL and execute code with the application's privileges. Required action is to apply vendor mitigations under BOD 26-04 by November 3, 2026, or stop using the product if mitigations are unavailable. Known ransomware campaign use is listed as unknown.
Unconfirmed: CISA lists known ransomware campaign use as unknown.
- Affected products are all Siemens Software Center versions below V4.0.9.8.
- The catalog due date is November 3, 2026.
- Known ransomware campaign use is listed as unknown.
- Stakeholders must also follow CISA forensics triage requirements.
Impact: Local authenticated arbitrary code execution via a crafted DLL
| Product | Affected |
|---|---|
| Siemens Software Center | All versions < V4.0.9.8 |
- 1.Apply mitigations in accordance with Siemens instructions and BOD 26-04.
- 2.Discontinue use if mitigations are unavailable.
- 3.Complete required action by November 3, 2026.
- CVEs
- CVE-2026-110936
- Vendors
- Siemens
- Products
- Software Center
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-110936 | DLL Search-Path Hijacking in Siemens Software Center | 8.4 | <1% | KEV | KEV |
From the original article
1 min read at cisa.govA vulnerability has been identified in Siemens Software Center (All versions < V4. 0. 9.
cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.