Full Report
Siemens security advisory (AV26-1063)
Analysis Summary
# Vulnerability: Siemens Software Center DLL Sideloading (CVE-2026-110936), Actively Exploited
## CVE Details
- CVE ID: CVE-2026-110936
- CVSS Score: Not provided in the source. See SSA-580366 for the official score.
- CWE: Not provided in the source. DLL sideloading is often mapped to CWE-426 (Untrusted Search Path), but this is unconfirmed.
## Affected Systems
- Products: Siemens Software Center
- Versions: All versions prior to V4.0.9.8
- Configurations: Not specified in the source.
## Vulnerability Description
Siemens Software Center is affected by a DLL sideloading vulnerability (SSA-580366). DLL sideloading occurs when an application loads a dynamic-link library from an untrusted location, such as the application's directory or another user-writable path, instead of a trusted system path. An attacker who can place a malicious DLL where the application will load it can cause that code to run in the application's context. The source does not give the exact trigger, the file paths involved, or the attacker privileges required.
## Exploitation
- Status: **Exploited in the wild.** Siemens reports that CVE-2026-110936 is being actively exploited.
- Complexity: Not specified in the source.
- Attack Vector: Not specified in the source. DLL sideloading generally requires the attacker to write a file to a location the application searches, which suggests a local or adjacent foothold, but this is an inference and should be verified against SSA-580366.
## Impact
The source does not state specific impact ratings. Because the flaw enables arbitrary code execution through a malicious DLL, the potential impact is generally high across confidentiality, integrity, and availability. Confirm against the vendor advisory.
- Confidentiality: Not specified in the source (likely high if code execution is achieved)
- Integrity: Not specified in the source (likely high if code execution is achieved)
- Availability: Not specified in the source (likely high if code execution is achieved)
## Remediation
### Patches
- Upgrade Siemens Software Center to **V4.0.9.8 or later**.
### Workarounds
- No workarounds are listed in the source. Until patching is complete, consider restricting write access to the Siemens Software Center installation directory and to directories on the DLL search path. Verify these measures with Siemens guidance before applying them.
## Detection
- Indicators of compromise: The source does not list specific IoCs (file hashes, filenames, or IPs). Check SSA-580366 and the Siemens exploitation news post for these.
- Detection methods (general guidance):
- Review the Siemens Software Center installation directory and other application paths for unexpected or recently modified DLLs.
- Monitor for Siemens Software Center processes loading DLLs from user-writable or non-standard directories.
- Audit recent file creation or modification events in directories the application uses.
- Review endpoint logs for unusual activity involving the application, and hunt for the presence of the vulnerable version.
## References
- Canadian Centre for Cyber Security, Siemens security advisory AV26-1063 (hxxps://www[.]cyber[.]gc[.]ca/en/alerts-advisories/siemens-security-advisory-av26-1063)
- Siemens SSA-580366: DLL Sideloading Vulnerability in Siemens Software Center (hxxps://productcert[.]siemens[.]com/productcert/html/ssa-580366[.]html)
- Siemens: Active Exploitation of CVE-2026-110936 in Siemens Software Center (hxxps://productcert[.]siemens[.]com/news/2026/10/19/active-exploitation-of-cve-2026-110936-in-siemens-software-center/)
- Siemens Product CERT (hxxps://productcert[.]siemens[.]com/)