Siemens Software Center DLL search path flaw (CVE-2026-110936) is actively exploited
Published 06/11/2026 10:12
Timeline
4 events over 18 d
- 19/10/2026ConfirmedVulnCheck KEV+1 d
- 20/10/2026CorroboratedCISA Known Exploited Vulnerabilities+0 min
- 20/10/2026ExploitedCISA Known Exploited Vulnerabilities+17 d
- 06/11/2026 10:12Published on WatchtowerPro CISO
In short
Siemens Software Center (SSC) versions below V4.0.9.8 load DLLs from an uncontrolled search path (CWE-427), which lets a local attacker run code with the application's privileges. Siemens and CISA confirm active exploitation, and CISA added the CVE to its KEV catalog on 20/10/2026. Version V4.0.9.8 or later fixes it, and existing installs update automatically on next startup. GreyNoise reports a public exploit for CVE-2026-110936; listed by CISA as known exploited (29/10/2026).
How bad is it
High. An attacker with access to the machine can run their own code on it, without anyone clicking. It is being exploited.
Being exploited - on CISA's known-exploited list since 20/10/2026.
Severity score
CVSS 4.0 from NVD, from siemens.com, read 11/11/2026.
What an attacker needs
- Internet access to itLocal access needed
- A loginAn admin account
- A user to clickNo
- Special settingsNo
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Run their own code on the system
- Read the data it holds
- Change or delete that data
- Take it offline
Type: code execution.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- Siemens Software Center (SSC), the desktop app for Windows and Linux used to download, install, activate and manage Siemens Digital Industries software: all versions below V4.0.9.8.
- Machines where SSC has not been started since the fix are still exposed, because the auto-update only runs at startup.
What to do now
- Update Siemens Software Center to V4.0.9.8 or later. Existing installs update automatically on next startup, so start SSC on every install. You can also download the latest version manually. Check the installed version on every machine.
- If an install cannot be updated, apply the vendor mitigations. CISA's KEV action says to discontinue use of the product where no mitigations exist.
- Follow Siemens's general guidance: protect network access to devices and run them in a protected IT environment.
- These interim measures reduce exposure and do not make a system safe. Only the update fixes the flaw.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 5 open questions, followed up as sources answer and all 5 sources with their dates. And technology matching: which of your systems run Siemens Software Center, at which version, fixed or not - and what each one needs.
Main sources
Known exploited: Siemens Software Center - Siemens Software Center Uncontrolled Search Path Element Vulnerability Vendor · Known Exploited Vulnerabilities Catalog Research · CISA Adds Six Known Exploited Vulnerabilities to Catalog Research