CVE-2026-110936: Siemens Software Center DLL Hijack (KEV)

CVE-2026-110936 is an uncontrolled search path (DLL hijacking) vulnerability in Siemens Software Center that lets an authenticated local attacker plant a malicious DLL for Software Center to load, achieving code execution with its privileges; Siemens confirmed active exploitation in the wild through a trojanized Software Center installer bundled with malicious DLLs, and CISA added the CVE to its KEV catalog on 2026-10-20.

CVE-2026-110936 is an uncontrolled search path element vulnerability (CWE-427) in Siemens Software Center versions before V4.0.9.8. The affected application loads dynamic-link libraries (DLLs) from a search path it does not fully control, so an authenticated local attacker can place a specially crafted DLL in a directory the application searches and have it loaded, leading to arbitrary code execution with the privileges of Software Center (NVD; Siemens SSA-580366).

NVD records the vulnerability as fully analyzed (status "Analyzed"), carrying the Siemens-submitted scores of CVSS v3.1 6.7 (vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and CVSS v4.0 8.4 — local attack vector, low complexity, but requiring high privileges already on the host, no user interaction, and high impact to confidentiality, integrity and availability once exploited (NVD).

On 2026-10-19, Siemens' ProductCERT published a separate notice stating it had "validated that there is an active exploitation of CVE-2026-110936" after threat actors distributed a legitimate, signed copy of Software Center (version 3.5.8.7) alongside malicious DLL files that the vulnerable build loaded from its own directory without validation; Siemens stressed that "no Siemens system, product or update channel was breached to our knowledge" and that the trojanized bundle was distributed outside official channels (Siemens — Active exploitation notice).

CISA added CVE-2026-110936 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-10-20 with a required-action due date of 2026-11-03, directing agencies to apply Siemens' mitigation and follow CISA's BOD 26-04 risk-based patching guidance (CISA KEV).

Siemens' fix updates affected installs to Software Center V4.0.9.8 or later; the vendor notes existing installs "will be auto updated on next startup," and recommends only downloading Siemens software from official Siemens sources, blocking the indicators of compromise published in the active-exploitation notice, and reviewing logs for prior contact with them (Siemens SSA-580366; Siemens — Active exploitation notice).

As of 2026-10-21, FIRST scores the probability of exploitation at 0.0026 (17.1th percentile) (FIRST EPSS) — modest for a mass-scanned remote bug, but consistent with a vulnerability that needs existing local access and is instead being delivered through a trojanized installer rather than internet-wide scanning.

Any organization running Siemens Software Center should update to V4.0.9.8 or later immediately, obtain it only from Siemens' official distribution channels, and check for the indicators of compromise Siemens published given the confirmed in-the-wild use.

• Uncontrolled search path element (CWE-427): Software Center loads DLLs from a search path it does not fully control, letting a local attacker plant a crafted DLL for code execution. — NVD
• CVSS v3.1 base score 6.7 (vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and CVSS v4.0 8.4, both Siemens-submitted and recorded by NVD under status Analyzed. — NVD
• Siemens validated active exploitation via a trojanized, signed Software Center installer (v3.5.8.7) bundled with malicious DLLs; no Siemens channel was breached. — Siemens Active Exploitation Notice
• Added to the CISA KEV catalog on 2026-10-20 with a required-action due date of 2026-11-03. — CISA KEV
• Fix is Software Center V4.0.9.8 or later; existing installs auto-update on next startup. — Siemens SSA-580366
• EPSS score is 0.0026 (17.1th percentile) as of 2026-10-21. — FIRST EPSS