CVE-2026-110936
Uncontrolled search path allows local code execution in Siemens Software Center
Siemens Software Center loads DLLs from directories an attacker can control. An authenticated local attacker can place a malicious DLL to run code with the application's privileges. All versions before 4.0.9.8 are affected, and CISA confirms active exploitation.
Siemens Software Center · Updated 28 Oct · From the public records
Being exploitedYesAttackers are using it
CISA known exploitedListedAdded 20 Oct; US agencies must fix by 3 Nov
SeverityhighCVSS 8.4 of 10
FixAvailableFixed versions below
Am I affected?
If you run a version older than the fixed one for your line, yes.
| Version line | Fixed in |
|---|---|
| Siemens Software Center V4.0 | V4.0.9.8 |
What to do
- Update Siemens Software Center to version 4.0.9.8.
- Follow CISA's directive for US federal agencies to patch by November 3, 2026.
What happened
- 20 OctCISA added this vulnerability to its Known Exploited Vulnerabilities catalog, indicating active exploitation.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-110936 | Siemens Software Center Uncontrolled Search Path Element Vulnerability | high 8.4 | 20 Oct | 1.0% |
Our reporting
We have not reported on it. It is here because CISA added it to its list of flaws under attack.
Reported elsewhere
CISA · 20 OctCISA Adds Six Known Exploited Vulnerabilities to Catalog ↗The records
CISA known-exploited catalog ↗CVE-2026-110936 on NVD ↗Is anything you run affected?Members connect Zotpaper to their AI assistant. It checks your own project against every vulnerability on this page and the others we track, and says what to update.
How it works