CVE-2026-110936: Siemens Software Center DLL Side-Loading Vulnerability Actively Exploited

Overview

CVE-2026-110936 is an uncontrolled search path element vulnerability affecting Siemens Software Center. An authenticated local attacker can exploit this by placing a specially crafted DLL in a directory searched by the application, leading to arbitrary code execution. This vulnerability is actively being exploited in the wild, making immediate patching crucial for affected organizations.

Technical Analysis

The vulnerability, classified as CWE-427 (Uncontrolled Search Path Element), resides in how Siemens Software Center loads dynamic-link libraries. The application searches an uncontrolled path, allowing an attacker to introduce a malicious DLL. When the Siemens Software Center application is subsequently executed, it loads the attacker’s DLL instead of a legitimate one, resulting in arbitrary code execution with the privileges of the affected application.

• Vulnerability Type: Uncontrolled Search Path Element (CWE-427)
• Affected Products: Siemens Software Center, all versions prior to V4.0.9.8
• Attack Vector: Local, authenticated attacker (AV:L, PR:H)
• Impact: Arbitrary code execution (C:H, I:H, A:H)
• CVSS 3.1 Score: 6.7 (Medium)
  • Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Detection

Defenders should focus on monitoring for unusual process execution patterns originating from the Siemens Software Center application, as well as suspicious file modifications in relevant directories.

• Process Creation Monitoring: Look for SiemensSoftwareCenter.exe spawning unusual child processes, especially command shells (cmd.exe), scripting interpreters (powershell.exe, wscript.exe, cscript.exe), or other unexpected executables.
• DLL Load Monitoring: Monitor for SiemensSoftwareCenter.exe loading DLLs from non-standard or user-writable directories (e.g., user profile directories, temporary folders) rather than system or application installation paths.
• File System Monitoring: Detect creation or modification of new DLL files in directories that SiemensSoftwareCenter.exe is known to search, particularly if these files are written by processes other than legitimate installers or update mechanisms.

Sigma Detection Rules

Siemens Software Center Spawning Shell

title: Siemens Software Center Spawning Shell
id: 9283740e-1a2b-4c3d-5e6f-789012345678
status: experimental
description: Detects suspicious child process creation by Siemens Software Center, indicative of arbitrary code execution via DLL side-loading (CVE-2026-110936).
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|endswith: '\\SiemensSoftwareCenter.exe'
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
      - '\\wscript.exe'
      - '\\cscript.exe'
  condition: selection
level: high

Mitigations

Prioritize patching and implement robust access controls to limit the potential impact of this vulnerability.

1. Patch Immediately: Update Siemens Software Center to version V4.0.9.8 or later. Refer to the official Siemens advisory for specific update instructions.
2. Least Privilege: Ensure that users operating Siemens Software Center do so with the absolute minimum necessary privileges. This limits the impact of arbitrary code execution.
3. Restrict Write Access: Implement strict file system permissions to prevent unauthorized users from writing files, especially DLLs, into directories within the application’s search path.

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-110936
• https://cert-portal.siemens.com/productcert/html/ssa-580366.html
• https://productcert.siemens.com/news/2026/10/19/active-exploitation-of-cve-2026-110936-in-siemens-software-center/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-110936
• https://ltna.com.au/cyber
• https://socprime.com/blog/cve-2026-110936-analysis/

Indicators of Compromise

MITRE ATT&CK

• T1574.001 — DLL
• T1059 — Command and Scripting Interpreter
• T1053.005 — Scheduled Task
• T1036.005 — Match Legitimate Resource Name or Location
• T1204.002 — Malicious File
• T1566.002 — Spearphishing Link
• T1082 — System Information Discovery
• T1218.007 — Msiexec
• T1140 — Deobfuscate/Decode Files or Information
• T1083 — File and Directory Discovery
• T1059.001 — PowerShell
• T1547.001 — Registry Run Keys / Startup Folder
• T1562.001 — Disable or Modify Tools
• T1078 — Valid Accounts
• T1027 — Obfuscated Files or Information
• T1486 — Data Encrypted for Impact
• T1218.010 — Regsvr32
• T1518.001 — Security Software Discovery
• T1059.003 — Windows Command Shell
• T1071.001 — Web Protocols
• T1574.002 — DLL Side-Loading
• T1105 — Ingress Tool Transfer