CVE-2026-110936: Siemens Software Center Uncontrolled DLL Search Path Enables Code Execution

Background

Siemens Software Center is the desktop client used to download, install and update Siemens engineering and product lifecycle software on Windows workstations. It sits on engineering machines in manufacturing, automotive, aerospace and energy organisations, and it runs with the rights needed to install software.

CVE-2026-110936 is an uncontrolled search path element vulnerability (CWE-427). Siemens published advisory SSA-580366, and the CVE record appeared on 15 October 2026. CISA added it to KEV on 20 October with a remediation date of 3 November 2026.

Technical Mechanism

The flaw is the classic DLL search-order problem. When the application loads a library without a fully qualified, trusted path, Windows searches a sequence of directories. If an attacker can place a DLL with the expected name in a directory that is searched before the legitimate one, the application loads the attacker’s code and runs it inside its own process.

CISA’s description says an authenticated local attacker could place a specially crafted DLL in a directory the application searches, leading to arbitrary code execution with the privileges of the affected application. Two scores apply. The CVSS 4.0 score is 8.4 (AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) and the CVSS 3.1 score is 6.7 (AV:L/AC:L/PR:H/UI:N). The vector requires high privileges, so the headline 8.4 overstates what a low-privileged user can do. We use the CVSS 4.0 figure in the frontmatter because it is the higher published score, and we flag the discrepancy here.

We have not found a public proof of concept or a technical write-up naming the specific DLL or the directory. Anything claiming those details should be treated as unverified.

Real-World Exploitation Evidence

CISA’s KEV listing is the confirmation that exploitation has been seen. Siemens’ advisory says: “Please refer to our blog post for additional information about current known active exploitation and how to detect it”, and its revision history notes the addition of a reference to that blog post. We could not locate the blog post during our research, so we have no verified detail on who is exploiting this, against which targets or with what payload. One CVE aggregator lists no public exploit code. That reflects the public record at the time of writing and does not show that attacks have not happened.

CISA lists known ransomware campaign use as “Unknown” and forensic triage as “No”. Check the Siemens advisory and blog post directly for the latest details.

Impact Assessment

Exploitation needs a foothold: a local, authenticated attacker. For a threat actor that already has a user session on an engineering workstation, a DLL planted for Software Center can provide code execution inside a trusted Siemens process, which can help evade application allow-listing and blend in with expected activity. Where the process runs with elevated rights, it can also be a step towards higher privileges. That is our reading of the mechanism, not an exploitation report.

The real exposure is in engineering environments. Those workstations hold product designs, plant configuration and credentials that reach OT-adjacent systems.

Affected Versions

Remediation Steps

1. Update to V4.0.9.8 or later. Siemens says existing installations auto-update on next startup, so launching the application on each workstation is the quickest route.
2. Confirm the version on each engineering workstation, particularly machines that are rarely launched or are offline. Those are the ones that miss an auto-update.
3. No workaround is listed by Siemens. Its general guidance is to protect network access to devices and follow its operational guidelines for industrial security.
4. Reduce write access. Check that standard users cannot write to directories in the application’s search path or to the install location.

Detection Guidance

Siemens points to its blog post for detection details, which we could not retrieve. In the meantime, these are our suggestions:

• Image-load events. In Sysmon (event ID 7) or EDR telemetry, look for the Software Center process loading unsigned DLLs, or DLLs from user-writable paths.
• File creation. Flag new DLLs written into the Software Center install directory or working directory, especially by processes other than the Siemens installer.
• Child processes. Watch for command shells or scripting engines launched by the Software Center process.
• Inventory. Query endpoint management for installed versions below V4.0.9.8.

Timeline

References

• Siemens ProductCERT: SSA-580366
• NVD: CVE-2026-110936
• CISA: BOD 26-04