6.7
Medium
Exploited
CVE-2026-110936 Siemens Software Center Uncontrolled Search Path Element Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Ransomware campaigns
Not observed so far
Weakness
CWE-427
Description
A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Siemens Software Center 4.0 | earliest → < 4.0.9.8 | 4.0.9.8 |
References
- cert-portal.siemens.com cert-portal.siemens.com
Timeline
- Published
- Added to the KEV catalogue
- Last modified
Other CVEs of Siemens Software Center
The 4 CVEs of Siemens Software Center →
CVE-2025-40745
A vulnerability has been identified in Siemens Software Center (All versions < V3.5.8.2), Simcenter 3D (All versions <…
3.7
Low
CVE-2025-40827
A vulnerability has been identified in Siemens Software Center (All versions < V3.5), Solid Edge SE2025 (All versions…
7.8
High
CVE-2021-41544
A vulnerability has been identified in Siemens Software Center (All versions < V3.0)
7.8
High