> ## Content Index
> Fetch the complete content index at: https://securexion.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# CVE-2026-110936: Siemens Software Center DLL Search Path Flaw Allows Local Privilege Escalation
- URL: https://securexion.com/cve-2026-110936-2/
- Published: 2026-10-23T06:45:20.000Z
- Updated: 2026-10-23T06:45:20.000Z
- Description: Siemens Software Center versions before 4.0.9.8 load dynamic libraries from an uncontrolled search path, allowing an authenticated local attacker with high privileges to place a malicious DLL and achieve code execution. This is actively exploited.
- Author: Securexion Team
- Tags: Vulnerability, High, Actively Exploited, #brief-2026-10-23

The vulnerability exploits a classic DLL hijacking pattern: Siemens Software Center searches for library dependencies in directories it does not fully control, and an attacker with high local privilege can plant a malicious DLL in one of those directories. When the application loads the library, the attacker's code executes with the application's privileges.

| CVE                       | CVE-2026-110936                                                              |
| ------------------------- | ---------------------------------------------------------------------------- |
| Severity                  | High (CVSS 6.7)                                                              |
| Actively exploited        | Yes, listed in CISA's Known Exploited Vulnerabilities catalog on 20 Oct 2026 |
| CISA remediation deadline | 3 Nov 2026                                                                   |
| Weakness                  | CWE-427 (uncontrolled search path)                                           |
| Attack vector             | Local                                                                        |
| Privileges required       | High                                                                         |
| User interaction          | None                                                                         |
| Published                 | 15 Oct 2026                                                                  |

## How the attack works

An authenticated local attacker with high privilege places a specially crafted DLL file in a directory that Siemens Software Center searches during startup or runtime. Because the application does not validate the DLL origin or use a hardened search path (e.g., System32 only), it loads the attacker's DLL. The malicious code then runs with the privileges of the Software Center process.

## Who is affected

Organizations running Siemens Software Center versions prior to 4.0.9.8 are vulnerable. This includes all legacy deployments on Windows systems where high-privilege users can write to accessible directories.

**Affected products listed:**

- Siemens Software Center (before 4.0.9.8)

## How to check if you're exposed

- Inventory Siemens Software Center installations and verify version (check application properties or vendor documentation)
- Confirm if any version is below 4.0.9.8
- Audit high-privilege user and system accounts for write access to directories in the application's search path
- Monitor for unexpected DLL files created in Software Center directories or system paths

## How to fix it

- Upgrade to Siemens Software Center version 4.0.9.8 or later from Siemens support
- Apply vendor security patches and restart the Software Center service

## If you can't patch yet

- Restrict high-privilege local account access to systems running Siemens Software Center
- Harden file permissions on directories in the Software Center search path to prevent unauthorized file creation
- Monitor and log all DLL loading by the Software Center process to detect suspicious library loads

---

*Need help checking your exposure or patching at scale?* [*FutureOps InfoTech*](https://futureopstech.com/?ref=securexion.com) *can help.*