IM
IronMonkey Threat Research
‹ Back to ICS Advisories

SSA-580366: DLL Sideloading Vulnerability in Siemens Software Center

MEDIUM
CVSS 6.7
Date 2026-10-15T00:00:00+00:00
Source siemens-productcert
Published by Siemens ProductCERT

// Description

The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application. Siemens is preparing fixes and recommends mitigations for products where fixes are not yet available. Currently the fix is expected in the week commencing 19th of October, 2026.

// Vulnerabilities (1)

CVE ID CVSS Score Severity Description
CVE-2026-110936 6.7 medium
CVE-2026-110936. The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.

// References