CVE-2026-110936

MediumCVSS 6.7

Published: 15/10/2026(UTC)Updated: 15/10/2026(UTC)Translated: 15/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

3th percentile - higher than 3% of all known CVEs

Summary

In Siemens Software Center (all versions), the application loads dynamic-link libraries (DLLs) from an uncontrolled search path. An authenticated local attacker could place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.

Risk Assessment

A local attacker can execute arbitrary code with the application's privileges, potentially leading to system compromise or privilege escalation.

Recommendation

Update Siemens Software Center to the latest version if a fix is available, or restrict local user privileges and monitor for unauthorized DLLs in application directories.

Other vulnerabilities in Siemens Software Center

CVE-2025-40745Low
A vulnerability in Siemens products allows an unauthenticated remote attacker to perform man-in-the-middle attacks due to improper validation of client certificates when connecting to the Analytics Service endpoint.

Original NVD description (English source)

A vulnerability has been identified in Siemens Software Center (All versions). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS