Siemens Software Center: CVE-2026-110936 Exploited in the Wild

What it is and who is affectedCVE-2026-110936 is an uncontrolled search path element vulnerability (CWE-427) in Siemens Software Center. According to...

What it is and who is affected

CVE-2026-110936 is an uncontrolled search path element vulnerability (CWE-427) in Siemens Software Center. According to the National Vulnerability Database (NVD) of NIST, every version below V4.0.9.8 is affected. The flaw was published in the NVD on 15 October 2026.

The mechanism is well known to anyone who administers Windows endpoints: the application loads dynamic-link libraries (DLLs) from a directory it does not control. An attacker who already has an authenticated local session can drop a specially crafted DLL into a folder the application searches, and the application will load it. The result is arbitrary code execution with the privileges of the affected application.

Two details matter for risk assessment. First, the attack requires local access and authentication, so it is not something a random visitor triggers from the internet. Second, the impact once it succeeds is full: confidentiality, integrity and availability are all marked high in the CVSS 4.0 vector. The score is 8.4, rated HIGH — serious, but not critical on the CVSS scale.

In practice this concerns organisations running Siemens Software Center on workstations or servers used for industrial software management: manufacturers, engineering firms, maintenance providers and any company with operational technology on site. In Catalonia that includes a good number of industrial SMEs around Barcelona, Lleida, Tarragona and Girona, often with a small IT team that also covers everything else.

Why it is urgent: already exploited, with a deadline

This is not a theoretical flaw waiting for a proof of concept. CISA added CVE-2026-110936 to its Known Exploited Vulnerabilities (KEV) catalogue on 20 October 2026, which means there is confirmed exploitation in real attacks. Siemens itself published a notice on 19 October 2026 about active exploitation of this CVE.

The KEV listing comes with a binding deadline for US federal agencies: 3 November 2026. CISA asks them to apply mitigations following the vendor's instructions, in line with BOD 26-04 guidance on risk-based security updates, and to follow its forensics triage requirements. Where mitigations are unavailable, the guidance is to discontinue use of the product. It also puts the responsibility on each asset owner to evaluate internet exposure.

For a Spanish SME the deadline is not legally binding, but the logic behind it is: a vulnerability that is being exploited today and whose fix already exists is exactly the kind of exposure that should not survive the week. There is no record of use in ransomware campaigns in the available material, which is good news but not a reason to wait.

What to do today

Check whether the product is installed and at which version. Look for Siemens Software Center on engineering workstations, build machines and any server used to distribute or update Siemens software. Anything below V4.0.9.8 is in scope.
Apply the vendor update. Siemens has published security advisory SSA-580366 with the patch and guidance. Follow the version and steps indicated in that advisory rather than assuming a specific build number.
Review signs of intrusion. Because the attack needs an authenticated local session, look at who has logged on to the affected machines, whether unexpected DLLs have appeared in application directories, and whether accounts with local access have been used outside normal patterns.
Reduce what is exposed. Restrict local administrator rights, keep the machines off direct internet exposure where possible, and review remote access paths into the same network segment.
Document the decision. If the update cannot be applied immediately, record the compensating controls in place and set a date. Under GDPR, Article 32 requires appropriate technical measures, and an unpatched, actively exploited flaw is hard to justify to an auditor or to the AEPD.

How a cybersecurity team such as ALMC's can help

Most SMEs we work with do not lack goodwill; they lack time and a clear inventory. A vulnerability like this one is easy to miss because it lives on a handful of machines that nobody associates with "the website" or "the server".

That is where an external team earns its keep: auditing which software and versions are actually running across the estate, running pentesting to see how far an attacker with a foothold could go, hardening servers and workstations so that a dropped DLL has fewer places to hide, and monitoring endpoints and logs for the kind of local activity this exploit requires. When something does go wrong, incident response and repair of compromised systems — including hacked WordPress, PrestaShop and Joomla sites — are part of the same job.

The pattern repeats: a vendor publishes a patch, CISA confirms exploitation, and the window between the two is short. Keeping a current inventory and a patching routine is less glamorous than a fire drill, but it is what keeps a Lleida workshop or an online shop in Barcelona out of the next KEV entry.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.