cyfenced.com →

[ CVE-2026-110936 · Published 15 Oct 2026 ]

DLL search path flaw in Siemens Software Center

Exploited · CISA KEV CVSS 6.7 EPSS <1%Fix available

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2026-10-20

[ Analyst view ]Is this a red alert for you?

Patch within days

CISA lists it as exploited, but it needs local access with high privileges.

Red alert if
You run Siemens Software Center on engineering workstations that may already be compromised.
Can wait if
You do not use Siemens Software Center, or local administrator access on those machines is tightly controlled and you patch in your next cycle.
What it is
Siemens Software Center before V4.0.9.8 loads DLLs from an uncontrolled search path. An authenticated local attacker can place a crafted DLL where the application looks for it and run code with the application's privileges.
Impact
The attacker needs a local, highly privileged account on the machine first. In engineering and industrial environments where Siemens tools are installed, this can let an attacker who already has a foothold hide code inside a trusted application.

How an attack would work MITRE ATT&CK

  1. T1078 Valid AccountsThe attacker already has a privileged local account on the workstation.
  2. T1574 Hijack Execution FlowA crafted DLL is placed in a folder that Software Center searches.
  3. T1036 MasqueradingThe code runs inside a trusted Siemens application, which helps it avoid notice.

What to do

  1. Update Siemens Software Center to V4.0.9.8 or later, following Siemens advisory SSA-580366.
  2. Check folders on the application's search path for DLLs that do not belong there.
  3. Limit local administrator rights on engineering workstations.
Written with AI from the sources on this page on 23 Oct 2026. Check the vendor's advisory before you act.

[ Description ]Official description

A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.

CISA: Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 3 Nov 2026): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

[ References ]References