LiveBreach Intelligence: data breaches, leaks & ransomware, tracked as they surfaceOngoing protection: GalaxyWarden →
Recent BreachesData breach tracker

CVE-2026-110936: Siemens Software Center Uncontrolled Search Path Element Vulnerability

RBRecent Breaches Vulnerability Intelligence·Oct 20, 2026
CVSS 8.4 · High⚠ Actively exploited (CISA KEV)
8.4
CVSS score
High
Severity
Active
CISA KEV
No
Ransomware use
Nov 3, 2026
Patch deadline
⚠ Exploited in the wild. CISA added CVE-2026-110936 to its Known Exploited Vulnerabilities catalog on Oct 20, 2026, with a federal patch deadline of Nov 3, 2026 — meaning attackers are actively using it. If you run the affected software, patch it immediately.

A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.

Details

AffectedSiemens · Software Center
WeaknessCWE-427
CVSS base score8.4 (High)
CVSS vectorCVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PublishedOct 15, 2026
Added to CISA KEVOct 20, 2026
Federal patch deadlineNov 3, 2026
Known ransomware useNot documented
Check if your data is exposed →

Frequently asked questions

Is CVE-2026-110936 being actively exploited?

Yes — CISA lists CVE-2026-110936 in its Known Exploited Vulnerabilities (KEV) catalog, so it is confirmed exploited in the wild. Patch it as a priority.

What does CVE-2026-110936 affect?

CVE-2026-110936 affects Siemens · Software Center.

How do I fix CVE-2026-110936?

Apply the vendor’s patch for the affected software. The federal patch deadline was Nov 3, 2026. Then check whether your personal data was exposed in any related breach.

References

Official records: NVD · CISA KEV

← All actively-exploited vulnerabilities