TL;DR: CVE-2026-110936 is a known-exploited vulnerability in Siemens Software Center. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Then confirm no exposed, unpatched instance remains on your perimeter.
What CVE-2026-110936 is
According to the public vulnerability record, A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.
CISA summarises it as: Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.
Affected product & severity
CVE-2026-110936 affects Siemens Software Center. Confirm exact affected and fixed versions against the vendor's advisory.
| Property | Detail |
|---|---|
| CVE | CVE-2026-110936 |
| Vendor | Siemens |
| Product | Software Center |
| CVSS | 6.7 (MEDIUM) |
| Vector | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| Weakness | CWE-427 |
| Added to CISA KEV | 2026-10-20 |
Why it is urgent
This CVE is in the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2026-10-20) — a list of flaws with confirmed exploitation in the wild. US federal agencies are required to remediate KEV entries on a deadline; for everyone else it is a strong signal to prioritise this now rather than wait. There is no proof-of-concept or exploit detail in this advisory by design.
What to do now
- Follow CISA's required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Apply the vendor's patch or mitigation for Siemens Software Center on every affected instance, per the official advisory linked below.
- Inventory every instance — production, staging, legacy and third-party appliances that bundle it. You cannot patch what you have forgotten you run.
- Verify the version actually deployed, not the one you think you run; the risk is the build actually serving traffic.
- Check for internet exposure. A known-exploited flaw on a reachable instance is an active risk — confirm none is exposed that should not be.
How to confirm your exposure
The hard part of a known-exploited CVE is rarely the patch — it is knowing where a reachable, unpatched instance still exists: a forgotten host, a staging box that drifted public, a third-party appliance. AssurePort's network and host penetration testing discovers exposed services, fingerprints their versions, and correlates them against known-exploited vulnerabilities — so a newly-weaponised CVE is checked against your real external footprint, including the hosts you don't have on a list. That is the window continuous testing is built to close.
Sources & further reading: NVD CVE-2026-110936 and the CISA KEV catalog are the authority on affected and fixed versions. Vendor/independent analysis: cert-portal.siemens.com, productcert.siemens.com, cisa.gov. This advisory contains no exploit code.
Frequently asked questions
What is CVE-2026-110936?
CVE-2026-110936 is a vulnerability in Siemens Software Center, rated MEDIUM (CVSS 6.7), listed in the CISA Known Exploited Vulnerabilities catalog. A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path.
Is CVE-2026-110936 being exploited?
Yes — it is in the CISA KEV catalog (added 2026-10-20), which lists vulnerabilities with confirmed in-the-wild exploitation. Treat it as an active, prioritise-now risk.
Which products are affected?
Siemens Software Center. Confirm the exact affected and fixed versions against the vendor's official security advisory before acting.
What should I do right now?
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Then inventory every instance, verify the version actually deployed, and confirm none is exposed and unpatched on your perimeter.