CISA has added CVE-2026-110936, a DLL search path vulnerability in Siemens Software Center that allows local code execution, to its Known Exploited Vulnerabilities catalog, which confirms it is being actively exploited.
What Is It
CVE-2026-110936 is an uncontrolled search path element vulnerability (CWE-427) in Siemens Software Center. The application loads dynamic-link libraries (DLLs) from a search path it does not control. An authenticated local attacker can place a specially crafted DLL in a directory the application searches. The result is arbitrary code execution with the privileges of the affected application.
NVD published the record on 2026-10-15. As of its last update on 2026-10-20, its status was "Undergoing Analysis."
Why It Matters
CISA added this CVE to the KEV catalog on 2026-10-20, which confirms active exploitation. The CISA Coordinator SSVC assessment in the NVD record also lists exploitation as active, technical impact as total, and automatable as no. Siemens has published a separate notice titled "Active exploitation of CVE-2026-110936 in Siemens Software Center."
Siemens scored the flaw with two CVSS versions:
- CVSS v4.0: 8.4 HIGH (
AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) - CVSS v3.1: 6.7 MEDIUM (
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
The attack is local and requires high privileges. When it succeeds, it has high impact on confidentiality, integrity and availability. KEV lists known ransomware campaign use as "Unknown."
What's Vulnerable
- Vendor: Siemens
- Product: Siemens Software Center
- Affected versions: All versions before V4.0.9.8
The NVD record lists no CPEs.
Patch Status
The affected range ends below V4.0.9.8. Check Siemens advisory SSA-580366 for the remediation guidance that applies to your environment.
CISA's required action is to apply mitigations according to vendor instructions, in compliance with BOD 26-04 (Prioritizing Security Updates Based on Risk) and CISA's "Forensics Triage Requirements." If mitigations are unavailable, follow the applicable BOD 26-04 guidance for cloud services or stop using the product. Stakeholders are responsible for evaluating each asset's internet exposure and following BOD 26-04 patching guidelines. KEV marks forensic triage as "No" for this entry.
Federal due date: 2026-11-03
Sources
- CISA KEV Catalog: CVE-2026-110936
- NVD: CVE-2026-110936
- Siemens ProductCERT SSA-580366 (cert-portal)
- Siemens ProductCERT SSA-580366 (productcert)
- Siemens: Active exploitation of CVE-2026-110936 in Siemens Software Center
- CISA BOD 26-04: Prioritizing Security Updates Based on Risk
- CISA BOD 26-04 Implementation Guidance (Forensics Triage Requirements)