SECURITY_THREAT_PULSE
LIVE
LAST UPDATED
FIRST SEEN
4 SOURCES ON THIS EVENT
▲ ACT NOWCVE-2026-110936 · CVSS 8.4

Siemens Software Center: attackers can run their own code

AFFECTSSiemens Software CenterSiemens Software Center

OFFICIAL NAME: Siemens Software Center Uncontrolled Search Path Element Vulnerability

WHAT IT IS · BUSINESS SOFTWAREIt runs day-to-day business work such as finance, printing, phones or manufacturing.

DO THIS FIRSTAsk the vendor or the team that owns it whether the fix is in. Not sure if you use it? Send this page to your IT provider or security lead and ask.

TECHNICAL SUMMARY Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.

WHY THIS VERDICT Attacks are confirmed. The vulnerability is 26 days old, so many systems are likely still unpatched.

WHY IT RANKS HERE Exploitation is confirmed by an authoritative source.

HIGHEST CONFIRMED RUNG
EXPLOITED
CISA KEV
LISTED
EXPLOIT CODE
PROOF OF CONCEPT CLAIMED
// EVIDENCE LADDER

How far has it climbed?

CONFIRMED
REPORTED
NO EVIDENCE

  1. 01 TALK

    ▨ REPORTED, NOT CONFIRMED
    NEWEST EVIDENCE NONE YET · 1 SOURCE

    Evidence is recorded but no summary is available.

    SRC: NONE YET

  2. 02 EXPOSED

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    We have no source that counts exposed systems yet. Internet scan data needs a partnership we do not have. No evidence here does not mean nothing is exposed.

  3. 03 TRIED

    ■ CONFIRMED
    NEWEST EVIDENCE · 2 INDEPENDENT SOURCES

    Attacks that worked are confirmed (step 4), so attempts count as confirmed too.

  4. 04 EXPLOITED

    ■ CONFIRMED
    NEWEST EVIDENCE · 2 INDEPENDENT SOURCES

    Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application. CISA Vulnrichment marks CVE-2026-110936 as actively exploited.

  5. 05 DAMAGE

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    Breach notices and filings rarely name the flaw that was used, so we cannot link them to this event yet. No evidence here does not mean no harm.

// THE CLOCK

When each thing happened

  1. DISCLOSED
    CVE-2026-110936 published
  2. EXPLOIT CODE PUBLIC
    CLAIMED
  3. FIRST ATTACK REPORT
    CISA Known Exploited Vulnerabilities
  4. CISA KEV LISTING
    CISA KEV listing
  5. US FEDERAL DEADLINE
    CISA deadline for US federal agencies
Attacks were reported 5 days after disclosure. CISA listed it 5 days after disclosure.

THE FIX

CISA's instruction: apply the vendor's fix, or stop using the product if no fix exists. The deadline CISA set for US federal agencies, Nov 3, 2026, has passed. It is a US government deadline; use it as a guide.

// ASK YOUR TEAM

Questions to ask this week

// TIMELINE · PACIFIC TIME

How it unfolded

  1. Attack activity. OCT 15, 2026
    CISA Vulnrichment marks CVE-2026-110936 as actively exploited
  2. Attack activity. OCT 19, 2026
    Siemens Software Center Uncontrolled Search Path Element Vulnerability
  3. OCT 20, 2026
    Siemens security advisory (AV26-1063) – Update 1
  4. OCT 21, 2026
    1 public GitHub repository claims a proof of concept for CVE-2026-110936

SOURCES

  1. [1] PoC-in-GitHub: 1 public GitHub repository claims a proof of concept for CVE-2026-110936, OCT 21
  2. [2] Canadian Centre for Cyber Security: Siemens security advisory (AV26-1063) – Update 1, OCT 20
  3. [3] CISA Known Exploited Vulnerabilities: Siemens Software Center Uncontrolled Search Path Element Vulnerability, OCT 19
  4. [4] CVE List V5 and CISA Vulnrichment: CISA Vulnrichment marks CVE-2026-110936 as actively exploited, OCT 15