Skip to main content
Apexward Pulse

EG Secure Solutions · Code execution

Siemens Software Center Uncontrolled Search Path Element Vulnerability

CVE-2026-110936

What this means

This is rated high severity (8.4 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether Siemens Software Center is in your estate, and treat that as the priority.

Full vendor description

A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.

Scoring and exploitation

8.4/ 10
CVSS 4.0 base scoreHigh

Exploitable only with local access and an administrator-level account, and no one has to click or open anything. High impact on confidentiality, integrity and availability.

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Exploitability

Longer bar: easier to attack

Attack vectorLocalAV:L
Attack complexityLowAC:L
Attack requirementsNoneAT:N
Privileges requiredHighPR:H
User interactionNoneUI:N

Impact

Longer bar: more harm

ConfidentialityHighVC:H
IntegrityHighVI:H
AvailabilityHighVA:H
~1% estimated chance of attack in 30 daysModel estimate (): a probability signal, not confirmed exploitation
Exploited in the wild
Yes — confirmed exploitation (US CISA )
Not reported
Listed product
Siemens Software Center

Weaknesses

CWE-427

Affected products ()

  • Siemens Software Center
Show the raw CPE strings (1)
  • cpe:2.3:a:siemens:software_center:*:*:*:*:*:*:*:*

References

3 links from the CVE record, grouped by site; the vendor's advisory comes first.

Related feed events

  • EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability

    Type Vulnerability

    CISA has added six new vulnerabilities to its known-exploited catalogue, based on evidence of active exploitation.

    Next step: Confirm whether EG Secure Solutions SiteGuard Server Edition is in your estate.

    Who's reporting

    1 of 3 perspectives

    Official authority: Official 2Vendor statement missing. no VendorResearcher coverage missing. no Researcher2 signals

    Only official coverage so far. Treat as an early signal.

    EG Secure Solutions SiteGuard Server Edition
    CVE-2026-106931+5

  • Siemens Software Center Uncontrolled Search Path Element Vulnerability

    Type Vulnerability

    Siemens Software Center has a vulnerability that could allow an authenticated local attacker to execute arbitrary code by placing a malicious DLL in a searched directory.

    Next step: Confirm whether Siemens Software Center is in your estate.

    Who's reporting

    1 of 3 perspectives

    Official authority: Official 3Vendor statement missing. no VendorResearcher coverage missing. no Researcher3 signals

    Only official coverage so far. Treat as an early signal.

    Siemens Software CenterFinancial ServicesAdvanced Manufacturing+1 more
    CVE-2026-110936