🟢 CVE-2026-110936

CVE-2026-110936 is a DLL search-order hijacking (CWE-427) vulnerability in Siemens Software Center (all versions < V4.0.9.8) that allows an authenticated local attacker to plant a malicious DLL in an uncontrolled search path, resulting in arbitrary code execution with the privileges of the application. The attack vector is strictly LOCAL (AV:L in both CVSS 3.1 and 4.0), requiring the attacker to have already established local authenticated access to the target machine. This is not a T1190 candidate — it is not internet-exploitable, targets a client-side software management tool rather than a public-facing service, and requires local system presence to exploit.

← Back to Overview
LOW_RISK
Risk Level
6.7
CVSS Score
LOCAL
Attack Vector
Privilege Escalation
ATT&CK Tactic
T1068 — Exploitation for Privilege Escalation
ATT&CK Technique
LOW
Deployment Risk
No
Ransomware

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: USER_INTERACTION

CVE Published: 2026-10-15

Added to CISA KEV: 2026-10-20 5 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

🔍 Web Intelligence (Kagi · 2026-10-20)

Summary

CVE-2026-110936 is a high-severity DLL side-loading vulnerability affecting the Siemens Software Center, where the application insecurely loads dynamic-link libraries (DLLs) from an uncontrolled search path. This flaw is significant because it allows an attacker to execute arbitrary code with the same privileges as the Siemens Software Center application, which is being actively exploited in the wild as part of "ClickFix" attack campaigns to compromise host systems.

Exploitation

  • Active Exploitation: The vulnerability is confirmed to be under active exploitation in the wild [3][7].
  • Threat Actors: The vulnerability has been linked to "ClickFix" attack campaigns, where attackers leverage the flaw to deploy malicious payloads [2][5].
  • Tool Availability: While specific exploit kits are not public, the nature of the vulnerability involves placing a specially crafted DLL in a directory that the software monitors; the mechanism is currently being utilized by threat actors [1].
  • Attack Prerequisites: This is a local attack that requires the attacker to have already established access to the system to place the malicious DLL [1]. It requires local authentication, though it does not necessarily require direct network-level exploitation by the attacker, instead relying on the execution of the Siemens software to trigger the load [4].

Affected Products & Patches

  • Affected Versions: All versions of Siemens Software Center prior to version 4.0.9.8 are affected [4][6].
  • Patches/Updates: Siemens fixed the vulnerability in version 4.0.9.8. Existing installations are configured to update automatically upon the next restart of the application [3].
  • Mitigations: Users should ensure the application is updated to version 4.0.9.8 or later; no other specific workarounds were detailed beyond the automated patch deployment [3].

Impact

  • Capability: Successful exploitation allows an attacker to achieve arbitrary code execution, granting them the same privileges as the Siemens Software Center process [1][2].
  • Business Risk: For internet-facing deployments or systems where the software is used, the risk is severe; attackers can use this as a foothold for further system compromise, data theft, or persistence within the environment, especially given its active use in current malicious campaigns [2].

Sources

  1. SSA-580366 - productcert.siemens.com

    Vulnerability CVE-2026-110936 The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the pr…

  2. ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy ...

    The high-severity vulnerability, tracked as CVE-2026-110936 (CVSS v4 score: 8.4), could allow an attacker to place a specially-crafted DLL in a directory the application searches, resulting in execution of malicious code with the same privileges as the affected service. ... The high-severity vulnera…

  3. Active Exploitation of CVE-2026-110936 in Siemens Software Center

    Active Exploitation of CVE-2026-110936 in Siemens Software Center Siemens has validated that there is an active exploitation of CVE-2026-110936, a DLL side-loading vulnerability in Siemens Software Center. Siemens fixed the weakness in version 4.0.9.8 and published advisory SSA-580366 on 15 October.

  4. CVE-2026-110936 - Vulnerability Details - OpenCVE

    The vulnerability in Siemens Software Center (all versions prior to V4.0.9.8) allows a local authenticated attacker to place a specially crafted DLL in a directory that the program searches for loads. Because the application uses an uncontrolled DLL search path, the crafted DLL is loaded and execute…

  5. Siemens Software Center DLL side-loading (CVE-2026 ...

    Siemens Software Center DLL side-loading (CVE-2026-110936) is being used in ClickFix attacks. The attacker ships the signed binary. Based on ...

Generated by PatchNow Intelligence System

Analysis based on CIRCL.LU data, Claude AI assessment, and MITRE ATT&CK framework

📄 Download JSON Data | 📡 RSS Feed