CVE-2026-110936

● Known-exploited MEDIUM

View CSAF Summary The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in...

Affects 0 products across 1 vendor.

CVSS 3.16.7
CVSS v48.4
EPSS1.0%
Percentile62th
PatchUnknown
Known-exploited since2026-10-20
CVSS Vector — Plain English Requires local access, low complexity, high privileges required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-427: CWE-427
Related Attack Patterns (CAPEC)
CAPEC-38 Leveraging/Manipulating Configuration File Search Paths
via CWE-427
CAPEC-471 Search Order Hijacking
via CWE-427

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A medium severity vulnerability (CVE-2026-110936) affects the target system. A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a speci...

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2026-110936?
A medium severity vulnerability (CVE-2026-110936) affects the target system. A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a speci...
What is the CVSS score for CVE-2026-110936?
CVE-2026-110936 has CVSS 6.7 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS: 1.0%.
Is CVE-2026-110936 actively exploited?
Yes. CVE-2026-110936 is in the CISA known-exploited catalog (added 2026-10-20). Active exploitation confirmed. Immediate patching required.
How do I remediate CVE-2026-110936?
Advisory: https://cert-portal.siemens.com/productcert/html/ssa-580366.html
What systems are affected by CVE-2026-110936?
CVE-2026-110936 affects Siemens.
Vulnerability Details
CVE IDCVE-2026-110936
CVSS VectorCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Published2026-10-15
Last Modified2026-10-22
ICS Relevance55%
Weakness (CWE)
CWE-427
SourceNVD
Official Description

View CSAF Summary The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application. Siemens has released a new version for Siemens Software Center and recommends to update to the latest version. Please refer to our blog post for additional information about

Source: NIST NVD / MITRE CVE Database

Affected Products
VendorProductAffected Versions
Siemens — —
Remediation
View Vendor Advisory →
Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 13 Days
CISA known-exploited● Active Exploitation Confirmed (added 2026-10-20)
Public ExploitNot confirmed
PoC CodeNot confirmed
Related CVEs affecting Siemens
CVE-2015-0235 10.0 Heap-based buffer overflow in the __nss_hostname_digits_dots function in glib... CVE-2020-11896 10.0 The Treck TCP/IP stack before 6.0.1.66 allows Remote Code Execution, related ... CVE-2024-3400 10.0 A command injection as a result of arbitrary file creation vulnerability in t... CVE-2012-5409 10.0 AscoServer.exe in the server in Siemens SiPass integrated MP2.6 and earlier d... CVE-2008-6916 10.0 Siemens SpeedStream 5200 with NetPort Software 1.1 allows remote attackers to...
View all Siemens CVEs →

This Vulnerability Is Being Actively Exploited

CVE-2026-110936 is on the CISA known-exploited list - confirmed active exploitation in the wild. BreachSpider flags known-exploited CVEs on the ICS assets they affect, with known-exploited status synced daily from CISA.

Create a free account →