ZeroDayAlert

CVE-2026-110936: Siemens Software Center Uncontrolled Search Path Element Vulnerability

Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.

Siemens Software Center Added to KEV 2026-10-20 Federal due 2026-11-03 Known ransomware use

Required action — quoted from CISA

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Where this comes from. The identifier, product, dates and required action above are copied verbatim from the CISA Known Exploited Vulnerabilities catalog. The action plan below is written by an AI agent from that record and published automatically. AssurePort has not independently tested this vulnerability and makes no claim about whether any specific system is affected.

Who is affected

Siemens Software Center is vulnerable to DLL search-path hijacking that permits authenticated local attackers to execute arbitrary code under the application's privileges. The vulnerability affects an unspecified version range; Siemens has not published the affected versions or patch availability in this record.

How to check whether this touches you

  • Inventory: search your infrastructure for deployments of Siemens Software Center; note the installed version and the user accounts that run it.
  • Privilege context: identify which system accounts have permission to write to directories that Software Center searches during startup or operation—particularly Windows temporary directories and the application's own folder hierarchy.
  • Patch status: contact Siemens directly or check their security advisories to determine whether a patch exists and, if so, the version number; version fingerprinting alone does not confirm whether mitigations have been backported.
  • Network exposure: confirm whether Software Center runs on machines accessible over the network or via remote access protocols, since exploitation requires local authentication but lateral movement may simplify access.

What to do

  1. Contact Siemens immediately to obtain the vendor's recommended mitigations and patch timeline, since the record does not specify remediation details.
  2. Until a patch is available, restrict write access to all directories that Software Center searches—especially system temporary paths and the application installation directory—using file system permissions and AppLocker or equivalent controls.
  3. Ensure that only necessary user accounts can authenticate to machines running Software Center; disable or constrain local login for service accounts.
  4. Enable and retain detailed audit logging of DLL loads, process creation, and file writes to directories within Software Center's search path; configure log forwarding to a centralized store with at least 90 days' retention.
  5. If Software Center is exposed to untrusted network access, disable or isolate that access until mitigations are confirmed; follow CISA's BOD 26-04 guidance for your organisation's risk tolerance.
  6. Escalate to your security team if you cannot restrict local access or if the application is business-critical and patching is delayed beyond the federal remediation due date of 2026-11-03.

If you find you were exposed

Review authentication logs and process execution logs on affected machines for dates prior to your patch or mitigation deployment, looking for suspicious DLL loads or process launches from temporary directories. DLL search-path attacks often leave evidence of failed DLL loads followed by successful loads from non-standard locations. Retention of Windows event logs (Event ID 7 for image load events) and Sysmon or EDR telemetry is essential; if logs have been purged, document the gap and note the last available log date.

Get these the morning they land.

One email, only when a vulnerability is newly confirmed as exploited — the CISA record plus our action plan. No more than one a day, and nothing on quiet days.

Knowing it exists is not the same as knowing you are exposed.

This page can tell you that CVE-2026-110936 is being exploited. It cannot tell you whether Software Center is running somewhere of yours that is reachable. That question is what a scan answers.

Check your own surface →