CVE-2026-110936

Description

A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.

Scoring

• CVSS: 6.7 (MEDIUM, 3.1)
• EPSS exploitation probability: Not yet available
• EPSS percentile: Not yet available

CISA KEV status

• Added to KEV: 2026-10-20
• Remediation due date: 2026-11-03
• Known ransomware campaign use: Unknown

Weakness types (CWE)

• CWE-427

References

• https://cert-portal.siemens.com/productcert/html/ssa-580366.html
• https://productcert.siemens.com/news/2026/10/19/active-exploitation-of-cve-2026-110936-in-siemens-software-center/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-110936

More from Siemens

• CVE-2016-8562 — SIMATIC CP