Active Exploitation of CVE-2026-110936 in Siemens Software Center

Siemens has released a security advisory regarding a high-severity DLL sideloading vulnerability in the Siemens Software Center (CVE-2026-110936). The vulnerability, which affects all versions prior to V4.0.9.8, allows unprivileged attackers to execute arbitrary code with the privileges of the target application. Siemens has confirmed that this vulnerability is currently being exploited in the wild. This flaw arises because the application improperly validates or specifies the search path for required dynamic link libraries (DLLs), enabling attackers to plant a malicious library in a directory where the application will prioritize it for loading over the legitimate system-provided file. This technique is a common method for achieving persistence and executing malicious payloads while evading traditional signature-based detection. Organizations using Siemens Software Center are urged to update to V4.0.9.8 or later immediately.

Impact

Successful exploitation of CVE-2026-110936 leads to arbitrary code execution on the host machine running Siemens Software Center. Given the nature of the application, this may allow an attacker to gain elevated privileges or maintain persistent access to the internal network. The vulnerability is being actively exploited, increasing the risk for all organizations currently running vulnerable versions of this software.

Recommendation

1. Upgrade all instances of Siemens Software Center to version 4.0.9.8 or later immediately to mitigate the underlying vulnerability CVE-2026-110936.
2. Audit environment for unexpected DLL files located in the installation directory of Siemens Software Center.
3. Implement endpoint monitoring for file creation events within application directories to identify unauthorized file placement.