Siemens Software Center DLL Hijacking (CVE-2026-110936)

Actively exploited in the wild - CVE-2026-110936 is a high-severity DLL search path hijacking flaw in Siemens Software Center (all versions before V4.0.9.8) that lets an authenticated local attacker drop a crafted DLL and run arbitrary code with the application’s privileges. Siemens has shipped V4.0.9.8; update immediately.

Overview

Siemens Software Center loads dynamic-link libraries (DLLs) from an uncontrolled search path. Instead of resolving every dependency from a trusted, fixed location, the application will also look in directories an attacker may control. An authenticated local user can place a specially crafted DLL in one of those searched directories. When Software Center next loads the library, it executes the attacker’s code instead of the legitimate one, running with the same privileges as the application.

The CVSS score is 8.4 (HIGH). The attack vector is LOCAL, complexity is LOW, privileges required are HIGH, and no user interaction is needed. In practice that means the attacker needs an existing account on the endpoint but does not need to trick anyone into clicking or opening anything. The low EPSS score (0.1% over the next 30 days) reflects that exploitation requires local access, but because the issue is already confirmed as exploited, the score should not be read as a reason to delay.

Impact

Successful exploitation results in arbitrary code execution under the context of Siemens Software Center. Because industrial engineering software often runs with elevated rights so it can install updates and manage packages, the resulting code may inherit broad permissions on the engineering workstation. That opens the door to persistence, tampering with installed software packages, credential theft, and lateral movement toward other systems on an operational technology network.

The confirmed in-the-wild exploitation elevates this from a hardening issue to an active threat for any environment where Software Center is installed and multiple users share the host.

Remediation and mitigation

• Update Software Center to V4.0.9.8 or later on every affected workstation. This is the only complete fix.
• Until patched, restrict local logon rights on engineering hosts and review who can write to application-adjacent directories.
• Audit the Software Center installation and working directories for unexpected DLL files, and enable DLL search order hardening where the operating system allows it.
• Monitor for DLLs written to application folders and for unexpected child processes spawned by Software Center.
• Review Siemens’ advisory for the official fixed release and any additional hardening guidance.

Security Insight

DLL search path hijacking remains one of the quietest ways to turn a low-complexity local foothold into code execution, and it keeps recurring because it is a build-time design choice rather than a memory-safety bug that tooling flags automatically. The fact that this flaw is exploited in the wild despite the high privilege requirement suggests attackers are pairing it with harvested credentials or shared engineering accounts, treating the workstation as the first hop rather than the target. For industrial software vendors, this is a reminder that install path hardening deserves the same threat modeling attention as the network-facing attack surface.

Breach reports are available at breach reports, and current cybersecurity news at security news.

Further Reading

• All High Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs