CVE-2026-110936: Siemens DLL Side-Loading Flaw
Active exploitation confirmed in CISA KEV.
Active exploitation confirmed in the wild. CISA added this to the KEV catalog on 2026-10-20. Federal agencies must patch by 2026-11-03.
TL;DR
- CVE-2026-110936 enables arbitrary code execution through DLL search-path hijacking in Siemens Software Center versions before 4.0.9.8.
- Authenticated local users are affected. Upgrade to version 4.0.9.8 or later and verify endpoint coverage.
- Exploitation is confirmed in the wild, and CISA lists the vulnerability in its Known Exploited Vulnerabilities catalog.
Summary
CVE-2026-110936 is an uncontrolled search path element vulnerability in Siemens Software Center. The application can load a malicious dynamic-link library from an attacker-controlled location. A successful attack allows arbitrary code execution with the privileges of the affected application.
The vulnerability has a CVSS base score of 6.7, but its operational priority is higher than the score alone suggests. Siemens has confirmed active exploitation, and CISA added the issue to its Known Exploited Vulnerabilities catalog on 2026-10-20. The CISA remediation deadline is 2026-11-03.
For background on identity controls that can reduce the impact of local compromise, see the identity and access management glossary. Organizations investigating suspected endpoint activity can also review this Windows digital forensics guide.
| Field | Detail |
|---|---|
| CVE ID | CVE-2026-110936 |
| Product | Siemens Software Center |
| Vulnerability type | Uncontrolled search path element, DLL side-loading |
| CVSS base score | 6.7 |
| Attack vector | Local |
| Authentication | Required |
| Privileges required | Local authenticated access is required; the precise CVSS privilege component should be confirmed against the authoritative NVD vector |
| User interaction | Not specified in the supplied scoring data |
| Patch available | Yes |
| Fixed version | Siemens Software Center 4.0.9.8 |
| CISA KEV | Yes |
| Active exploitation | Confirmed by Siemens |
| Known ransomware use | Unknown |
The supplied NVD result includes the 6.7 score but not the complete CVSS vector string. Defenders should retrieve the authoritative NVD record before using the vector for detailed risk modeling, compliance reporting, or automated prioritization.
Root Cause
The root cause is an uncontrolled DLL search path. Windows applications that load DLLs without sufficiently constraining search locations can be tricked into loading an attacker-supplied library instead of the legitimate library intended by the application. The attacker must first place the malicious DLL in a directory that Siemens Software Center searches.
This is commonly described as DLL search-order hijacking or DLL side-loading. The signed Siemens executable may remain legitimate while loading an unauthorized library distributed alongside it. That distinction matters during investigations: validating the executable’s signature alone does not establish that the complete execution chain is trusted.
Exploitation requires local authenticated access and does not represent a purely remote, unauthenticated network attack. An attacker who already has access to an endpoint, or who convinces a user to run software obtained outside official Siemens distribution channels, may be able to execute code with the privileges assigned to Siemens Software Center.
Who’s Exposed
The affected product is Siemens Software Center. Siemens and the NVD description identify all versions before 4.0.9.8 as affected. The fixed release is 4.0.9.8, and later versions should also be treated as remediated unless Siemens identifies a separate regression or limitation.
Organizations should inventory both managed and unmanaged Windows endpoints where Siemens engineering, industrial, automation, or related software is installed. A device may be exposed even if Software Center is not used daily, because the vulnerable application may launch during maintenance, software installation, update operations, or user activity.
| Product | Affected range | Fixed version |
|---|---|---|
| Siemens Software Center | All versions < 4.0.9.8 |
4.0.9.8 and later |
The supplied research does not provide a complete list of affected operating-system editions, installer package identifiers, or portable deployment variants. Do not infer that an endpoint is safe because it lacks a conventional enterprise software inventory record. Verify the installed Software Center version directly, including on engineering workstations, operator stations, jump hosts, and systems administered outside the central endpoint-management platform.
Technical Notes
A basic PowerShell inventory check can identify installed applications when Siemens Software Center is registered in standard uninstall locations:
$paths = @(
"HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*",
"HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*",
"HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"
)
Get-ItemProperty $paths -ErrorAction SilentlyContinue |
Where-Object { $_.DisplayName -match "Siemens Software Center" } |
Select-Object DisplayName, DisplayVersion, Publisher, InstallLocation
Because registration is not guaranteed, supplement this query with endpoint-management inventory and a filesystem search for the application executable. Treat any discovered version lower than 4.0.9.8 as vulnerable until upgraded and revalidated.
Analyst’s Take: Patch this as an actively exploited endpoint issue, not as a medium-severity item to queue behind remote vulnerabilities. The local-authentication requirement limits the attack path, but confirmed exploitation and Siemens’ warning about malicious files distributed alongside signed software make endpoint verification and investigation the first priorities.
Severity Breakdown
The CVSS base score is 6.7, which places the issue in the medium severity range under common CVSS interpretations. The score reflects important exploitation limitations: the attacker needs local access and authentication rather than being able to exploit the application directly from an untrusted network.
Those limitations should not be mistaken for low business risk. Local code execution can provide persistence, credential theft, lateral movement, or access to engineering and operational tooling. The CISA KEV listing and Siemens’ confirmed exploitation demonstrate that attackers are overcoming the local-access requirement in real campaigns.
The complete CVSS vector was not included in the supplied NVD result. Accordingly, the following components should be confirmed directly in the authoritative NVD entry before publication in a formal risk register:
| Component | Available assessment |
|---|---|
| Base score | 6.7 |
| Attack vector | Local |
| Attack complexity | Not provided in the supplied data |
| Privileges required | Authentication or local authenticated access required |
| User interaction | Not provided in the supplied data |
| Scope | Not provided in the supplied data |
| Confidentiality impact | Not provided in the supplied data |
| Integrity impact | Not provided in the supplied data |
| Availability impact | Not provided in the supplied data |
For operational prioritization, use confirmed exploitation status and asset criticality alongside CVSS. Internet exposure is not required for the vulnerability to matter: compromise of a workstation used to administer Siemens software may create a path into sensitive engineering environments.
Exploitation Status
Exploitation is confirmed in the wild. Siemens ProductCERT published an alert titled “Active Exploitation of CVE-2026-110936 in Siemens Software Center” and reported a malicious DLL side-loading campaign. CISA subsequently added the vulnerability to its KEV catalog on 2026-10-20.
Siemens reported that attackers distributed the signed program together with malicious files outside official Siemens distribution channels. The vendor associated the activity with the Romulus multi-platform ClickFix campaign. This attribution and campaign association should be used as investigative context, not as a substitute for validating endpoint and network evidence.
A public GitHub proof-of-concept repository was not identified in the supplied research. The absence of a public PoC does not reduce urgency: vendor-validated exploitation is stronger evidence than a PoC-only disclosure. CISA records known ransomware campaign use as unknown. Do not describe the vulnerability as ransomware-related unless future reporting provides that confirmation.
The relevant timeline is:
| Date | Event |
|---|---|
| 2026-10-15 | CVE published in the NVD record and Siemens advisory SSA-580366 published |
| 2026-10-19 | Siemens published its active-exploitation notice |
| 2026-10-20 | CVE added to the CISA KEV catalog |
| 2026-11-03 | CISA KEV remediation deadline |
Sources
-
Siemens ProductCERT, SSA-580366, Siemens Software Center vulnerability advisory:
https://cert-portal.siemens.com/productcert/html/ssa-580366.html -
Siemens ProductCERT, Active Exploitation of CVE-2026-110936 in Siemens Software Center:
https://productcert.siemens.com/news/2026/10/19/active-exploitation-of-cve-2026-110936-in-siemens-software-center/ -
CISA, Known Exploited Vulnerabilities Catalog, CVE-2026-110936:
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-110936 -
NVD, CVE-2026-110936 record. Confirm the authoritative record for the complete CVSS vector and any subsequent product or version updates.
Upgrade first, then verify coverage across managed and unmanaged endpoints. After that, investigate for malicious DLL side-loading and Romulus ClickFix-associated indicators, preserving relevant binaries, hashes, and telemetry where suspicious activity appears.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.
Detection Guidance
Detection should combine software inventory, process execution telemetry, DLL-load telemetry, file provenance, and network indicators from Siemens’ active-exploitation notice. A signed Siemens executable launched from an unusual user-writable directory, especially alongside unsigned DLLs, is more suspicious than the same executable launched from its expected installation path.
Investigators should examine downloads and archive extraction events preceding execution. Siemens specifically warned about signed programs distributed with malicious files outside official distribution channels. Review browser, email, proxy, and endpoint telemetry for software packages or archives that introduced the executable and adjacent DLLs.
Technical Notes
The following Microsoft Defender Advanced Hunting query is a starting point for identifying executable launches from user-writable locations. Adapt the paths and process names to the organization’s telemetry schema:
DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName endswith ".exe"
| where FolderPath has_any ("\\Users\\", "\\Downloads\\", "\\Temp\\", "\\AppData\\")
| where ProcessCommandLine has_any ("Siemens", "Software Center")
| project Timestamp, DeviceName, AccountName, FileName,
FolderPath, ProcessCommandLine, SHA256, InitiatingProcessFileName
| order by Timestamp desc
Where Microsoft Defender for Endpoint exposes DLL-load events, search for unsigned or newly created DLLs loaded by Siemens Software Center:
DeviceImageLoadEvents
| where Timestamp > ago(30d)
| where InitiatingProcessFileName has_any ("Siemens", "SoftwareCenter")
| where not(Signer has "Siemens")
| project Timestamp, DeviceName, InitiatingProcessFileName,
FolderPath, FileName, SHA256, Signer
| order by Timestamp desc
A Windows event investigation should correlate process creation, image-load, and file-creation records around the same timestamp. Useful indicators include:
- Siemens Software Center launched from
Downloads,Temp, or a user profile directory. - A DLL created immediately before the Siemens process starts.
- An unsigned DLL loaded by a signed Siemens executable.
- Software Center execution following an archive extraction or browser download.
- Outbound connections immediately after the suspicious process starts.
Siemens recommends searching logs for connections to indicators in its active-exploitation notice and blocking associated IP addresses and domains at firewalls, proxies, and DNS resolvers. Organizations should obtain the current indicator list directly from Siemens rather than copying incomplete or stale indicators into detection systems.
Remediation Steps
Upgrade Siemens Software Center to version 4.0.9.8 or later. Siemens states that existing installations update automatically the next time the application starts. Administrators should still initiate or allow application startup, verify that the update completed, and confirm the installed version through endpoint inventory.
Prioritize systems in engineering, manufacturing, automation, and administrative roles, as well as workstations that can access sensitive Siemens projects or operational networks. The CISA deadline is 2026-11-03, but confirmed exploitation means organizations should treat the update as an immediate action rather than waiting for the deadline.
Technical Notes
On installations where Siemens’ automatic update mechanism is available, start Siemens Software Center through the approved endpoint-management process, allow the update to complete, then verify the installed version. A generic PowerShell verification pattern is:
$expected = [version]"4.0.9.8"
$app = Get-ItemProperty @(
"HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*",
"HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*",
"HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"
) -ErrorAction SilentlyContinue |
Where-Object { $_.DisplayName -match "Siemens Software Center" } |
Select-Object -First 1
if ($null -eq $app) {
Write-Output "Software Center not found in uninstall inventory"
} elseif ([version]$app.DisplayVersion -lt $expected) {
Write-Output "VULNERABLE: $($app.DisplayVersion)"
} else {
Write-Output "REMEDIATED: $($app.DisplayVersion)"
}
The supplied material does not provide a standalone MSI product code, a vendor-approved silent-install command, or a verified package URL. Do not invent a deployment command or download source. Use Siemens’ official Software Center update mechanism and approved Siemens distribution channels. If automatic updating cannot be completed, obtain the supported installer from Siemens and deploy it through the organization’s software-management process.
Until upgrade is verified:
- Restrict execution of Siemens Software Center from user-writable directories.
- Prevent users from running Siemens software packages obtained from unofficial sites, unsolicited messages, or unknown archives.
- Apply application-control policies that allow approved Siemens binaries and block unexpected adjacent DLLs where technically feasible.
- Block the IP addresses and domains listed in Siemens’ active-exploitation notice.
- Isolate endpoints showing suspicious side-loading or campaign indicators.
- Preserve binaries, DLLs, hashes, event logs, and proxy records for investigation.
- Rotate credentials and assess lateral movement if unauthorized code execution is confirmed.
If a vulnerable endpoint cannot be patched promptly, reduce its network access and remove it from sensitive administrative paths where possible. CISA’s KEV guidance calls for applying vendor mitigations and prioritizing remediation based on risk. If mitigations are unavailable, organizations should evaluate discontinuing use of the affected software until it can be safely updated.
For organizations reviewing related intrusion activity, use the lateral movement detection guide to help structure endpoint and network investigations.