Critical Known exploited Patch available CVSS 6.7
Siemens Software Center flaw lets local attacker run code; exploitation reported
CISA ICS AdvisoriesSiemens · Critical Manufacturing, Transportation Systems, EnergyCVE-2026-110936
What happened. Siemens Software Center loads DLL files from an uncontrolled search path. An authenticated local attacker could plant a crafted file and run code with the application's privileges. Siemens released a fixed version. The report refers to known active exploitation.
Who is affected. Siemens Software Center versions before 4.0.9.8. Sectors named include critical manufacturing, transportation, energy, healthcare, financial services and government facilities.
What to do. Update Siemens Software Center to the latest version, at least 4.0.9.8. Check the vendor's blog post for how to detect the known active exploitation.
Editor's reading
Forasset ownerdetection engineer
- Purdue level
- L3
- L2
Why: Siemens Software Center is installed software that manages Siemens engineering tools, so it typically sits on engineering workstations (L2) and site servers (L3).
- Are you exposed?
Search the asset inventory of engineering workstations and servers for Siemens Software Center versions before 4.0.9.8.
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: CISA ICS Advisories (opens cisa.gov)
More on Siemens Manufacturing Transport Energy and power CVE-2026-110936