Actively exploited in the wild

Siemens Software Center Uncontrolled Search Path Element Vulnerability

Siemens - Software Center · Listed in the CISA KEV since 2026-10-20. This indicates confirmed attacks in production environments.

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CVE-2026-110936

MediumCVSS 6.7KEV

Published: 15/10/2026(UTC)Updated: 21/10/2026(UTC)Translated: 17/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

3th percentile - higher than 3% of all known CVEs

Summary

Siemens Software Center (all versions < V4.0.9.8) loads dynamic-link libraries (DLLs) from an uncontrolled search path. An authenticated local attacker can place a specially crafted DLL in a directory searched by the application, leading to arbitrary code execution with the application's privileges.

Risk Assessment

An attacker can execute arbitrary code with the application's privileges, potentially leading to system compromise.

Recommendation

Update Siemens Software Center to version V4.0.9.8 or later, which fixes the DLL loading issue.

Other vulnerabilities in Siemens Software Center

CVE-2025-40745Low
A vulnerability in Siemens products allows an unauthenticated remote attacker to perform man-in-the-middle attacks due to improper validation of client certificates when connecting to the Analytics Service endpoint.

Original NVD description (English source)

A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS