CVE-2026-110936: Siemens Software Center RCE Vulnerability

CVE-2026-110936 Overview

CVE-2026-110936 is a DLL hijacking vulnerability in Siemens Software Center versions prior to V4.0.9.8. The application loads dynamic-link libraries (DLLs) from an uncontrolled search path, which maps to [CWE-427]. An authenticated local attacker can place a specially crafted DLL in a directory searched by the application. When Siemens Software Center loads the malicious library, it executes arbitrary code with the privileges of the affected process. The vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild.

Critical Impact

Successful exploitation grants arbitrary code execution with the privileges of Siemens Software Center, enabling local privilege escalation and persistence on engineering workstations.

Affected Products

• Siemens Software Center, all versions prior to V4.0.9.8
• Engineering workstations running vulnerable Siemens Software Center installations
• Industrial control systems where Siemens Software Center manages software deployment

Discovery Timeline

• 2026-10-15 - CVE-2026-110936 published to the National Vulnerability Database
• 2026-10-19 - Siemens publishes advisory noting active exploitation
• 2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-110936

Vulnerability Analysis

Siemens Software Center loads DLLs using an uncontrolled search path. Windows applications resolve DLL names through a defined search order that includes the application directory, the current working directory, and directories listed in the PATH environment variable. When an application fails to specify fully qualified paths or omits safe search-mode flags, it loads the first matching DLL found along that path.

An attacker who can write to any directory in the search order can plant a malicious DLL with the expected filename. When Siemens Software Center starts or loads a module, it loads the attacker-controlled DLL instead of the legitimate one. The loaded code runs inside the Software Center process context, inheriting all of its privileges.

This class of flaw is classified under [CWE-427] Uncontrolled Search Path Element. Exploitation requires local access and valid credentials but no user interaction once the DLL is staged.

Root Cause

The root cause is improper DLL loading behavior. Siemens Software Center does not enforce absolute paths or restrict library resolution to trusted directories. The application also fails to apply SetDefaultDllDirectories or the LOAD_LIBRARY_SEARCH_SYSTEM32 flag, which would exclude attacker-writable paths from the search sequence.

Attack Vector

The attacker needs local access to the host and permission to write files into a directory within the DLL search path. After placing the crafted DLL, the attacker waits for a user or scheduled task to launch Siemens Software Center. When the application resolves the dependency, Windows loads the planted DLL and invokes DllMain, executing attacker code with the privileges of the running process. See the Siemens Security Advisory SSA-580366 for additional technical context.

Detection Methods for CVE-2026-110936

Indicators of Compromise

• Unsigned or unexpected DLLs in the Siemens Software Center installation directory or user-writable directories referenced in PATH
• Siemens Software Center processes loading DLLs from non-standard paths such as %TEMP%, %APPDATA%, or user profile directories
• New child processes spawned from the Software Center process that do not match normal application behavior
• Outbound network connections initiated by the Software Center process to unknown hosts

Detection Strategies

• Monitor Sysmon Event ID 7 (ImageLoad) for DLLs loaded by Siemens Software Center from writable or non-standard directories
• Alert on file creation events for DLL files in directories adjacent to the Software Center executable
• Baseline the legitimate DLL set shipped with Siemens Software Center V4.0.9.8 and alert on deviations

Monitoring Recommendations

• Enable PowerShell and command-line logging on engineering workstations to capture staging activity preceding DLL placement
• Forward endpoint telemetry to a centralized SIEM for correlation of file-write and image-load events
• Review scheduled tasks and auto-start entries that invoke Siemens Software Center to identify persistence opportunities an attacker could abuse

How to Mitigate CVE-2026-110936

Immediate Actions Required

• Upgrade Siemens Software Center to version V4.0.9.8 or later on all affected hosts
• Audit directories in the system and user PATH for write permissions granted to non-administrative accounts
• Review endpoint logs for prior DLL load events consistent with exploitation, given the CISA KEV listing
• Restrict local login rights on engineering workstations to reduce the authenticated attacker population

Patch Information

Siemens has released Siemens Software Center V4.0.9.8, which remediates CVE-2026-110936. Refer to the Siemens Security Advisory SSA-580366 and the Siemens notice on active exploitation for installer downloads and deployment guidance.

Workarounds

• Remove write permissions for standard users on the Siemens Software Center installation directory and parent folders
• Remove user-writable directories from the system PATH environment variable
• Apply AppLocker or Windows Defender Application Control policies to block unsigned DLLs from loading into Siemens Software Center
• Restrict interactive logon on hosts running Siemens Software Center until the patch is deployed

# Example PowerShell command to identify writable directories in PATH
$env:PATH -split ';' | ForEach-Object {
    if (Test-Path $_) {
        $acl = Get-Acl $_
        $acl.Access | Where-Object {
            $_.IdentityReference -match 'Users|Everyone|Authenticated' -and
            $_.FileSystemRights -match 'Write|Modify|FullControl'
        } | ForEach-Object {
            Write-Output "Writable PATH entry: $_"
        }
    }
}