What happened
A critical vulnerability has been identified in Siemens Software Center, classified under CVE-2026-110936. This flaw involves an uncontrolled search path element that could allow an authenticated local attacker to insert a specially crafted DLL into a directory searched by the application. Successful exploitation may lead to arbitrary code execution with the privileges of the affected application. The vulnerability has been confirmed as actively exploited in the wild, increasing the risk of malicious activity targeting affected systems.
Who is affected
Organisations operating installations of Siemens Software Center are affected by this vulnerability. The specific impact depends on the environment's configuration, especially where the application search paths can be manipulated by authenticated users. Systems with exposed or internet-connected interfaces are at greater risk if mitigations are not implemented. Affected deployments include those where the application search paths may be influenced by local users or, potentially, external actors if other vulnerabilities exist.
Recommended actions
- Since the vulnerability involves an exploited search path flaw, it is essential for affected organisations to apply mitigations following vendor instructions. Measures should include implementing security updates in line with guidance from relevant authorities, notably CISA’s BOD 26-04 prioritization and forensics requirements. If mitigations are unavailable, discontinuing the use of the affected product is advised. Stakeholders must evaluate each system's exposure to the internet and ensure that control measures are in place to prevent unauthorised local DLL placement that could lead to code execution.
