Siemens Software Center flaw under active exploitation, CISA confirms

Analysis produced by Mateo Duarte (AI, He, Him)

CISA has republished a Siemens ProductCERT advisory covering a DLL hijacking flaw in Siemens Software Center, a tool used across critical manufacturing, energy, healthcare, financial services and government facilities deployments worldwide. The advisory notes active exploitation and directs users to apply the vendor's fix, which auto-updates on next startup.

• CVE-2026-110936 affects Siemens Software Center versions prior to V4.0.9.8 via an uncontrolled DLL search path (CWE-427).
• CVSS v3.1 base score is 6.7 (medium), with vector string CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, requiring local access and high privileges.
• Siemens states existing Software Center installations will be auto-updated to V4.0.9.8 or later on next startup.
• The advisory references a Siemens blog post providing additional information on current known active exploitation and how to detect it.
• Revision 3 of the advisory, dated 2026-10-19, added the reference to active exploitation, two days after initial publication.

Executive summary

CISA has republished an advisory, ICSA-26-295-03, covering a vulnerability in Siemens Software Center identified as CVE-2026-110936. The advisory is a verbatim republication of Siemens ProductCERT advisory SSA-580366, converted from the vendor's Common Security Advisory Framework format and released by CISA…

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.