CVE-2026-110936KEV · due Nov 3CWE-427

Siemens Software Center Uncontrolled Search Path Element Vulnerability

Medium · published October 15, 2026

Patch now

The score understates this — it's already being exploited

CVSS calls it medium at 6.7. It is confirmed in active exploitation. It sits in the 14.0th percentile for exploit probability.

10
days to CISA
deadline
CVSS v3.1
6.7
EPSS
0%
Percentile
14.0
In the wild
Confirmed
What it is

A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.

The record
Technical detail
CVSS v3.1
6.7 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
8.4 · CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00238 · 14.0th percentile
Weakness
CWE-427 · Uncontrolled Search Path Element
Published
2026-10-15T19:17Z
KEV added
2026-10-20 · due 2026-11-03
Affected products (1)
ProductVersionsFixed in
siemens/software_center< 4.0.9.84.0.9.8
References (3)
https://cert-portal.siemens.com/productcert/html/ssa-580366.html · [email protected]https://productcert.siemens.com/news/2026/10/19/active-exploitation-of-cve-2026-110936-in-siemens-software-center/ · 134c704f-9b21-4f2e-91b3-4a467353bcc0https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-110936 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 17 OCT 03:28Z
    EPSS moved — → 0%
    epss
  • 15 OCT 14:01Z
    A vulnerability has been identified in Siemens Software Center (All versions)
    cvelistv5
  • 15 OCT 14:01Z
    A vulnerability has been identified in Siemens Software Center (All versions)
    cvelistv5