CVE-2026-110936: Siemens Software Center uncontrolled DLL load enables local privilege escalation
Siemens Software Center before version 4.0.9.8 searches for dynamic-link libraries (DLLs) in uncontrolled paths, allowing an authenticated local attacker to plant a malicious DLL and achieve code execution with the application's privileges. This is actively exploited.
Siemens Software Center's DLL loading mechanism does not properly control the search path, making it vulnerable to a classic DLL hijacking attack. An authenticated local user can place a specially crafted DLL in a directory that the application searches before legitimate system paths. When the application loads the library, the attacker's code executes with the same privileges as the Software Center process.
| CVE | CVE-2026-110936 |
|---|---|
| Severity | High (CVSS 6.7) |
| Actively exploited | Yes, listed in CISA's Known Exploited Vulnerabilities catalog on 20 Oct 2026 |
| CISA remediation deadline | 3 Nov 2026 |
| Weakness | CWE-427 (uncontrolled search path) |
| Attack vector | Local |
| Privileges required | High |
| User interaction | None |
| Published | 15 Oct 2026 |
How the attack works
The application constructs a list of directories to search for required DLLs and does not properly prioritize secure system directories. An attacker with local access places a DLL with a standard Windows library name (or a name matching a dependency) in a user-writable directory, a temp folder, or another location the application searches early. When Software Center loads its dependencies, it finds and loads the attacker's DLL instead of the legitimate one. The malicious code then executes in the application's security context.
Who is affected
Siemens Software Center versions prior to 4.0.9.8 are vulnerable. Any deployment running version 4.0.9.7 or earlier is exposed.
Affected products listed:
- Siemens Software Center (before 4.0.9.8)
How to check if you're exposed
- Query deployed assets for Siemens Software Center version (Help > About or registry HKLM\Software\Siemens)
- Identify any instance running version before 4.0.9.8
- Monitor user-writable directories and temp folders on Software Center hosts for unexpected .dll files
- Review process execution logs for Software Center launching child processes or executing code from unusual paths
How to fix it
- Upgrade Siemens Software Center to version 4.0.9.8 or later
- After patching, scan and clean any unauthorized or suspicious DLL files from common search paths (user temp, application directories, current working directory)
If you can't patch yet
- Restrict local login and administrative privileges on systems running Siemens Software Center; limit which user accounts can install or modify software
- Set file-system permissions on application directories and temp folders to prevent unauthorized users from writing executables
- Monitor DLL loading via endpoint detection and response (EDR) or security event auditing; alert on execution of DLLs from unexpected paths
Need help checking your exposure or patching at scale? FutureOps InfoTech can help.