Siemens Software Center Local Privilege Escalation Vulnerability

Catalog analysis: CISA added this entry on October 20, 2026. The entry reflects catalog information retrieved on October 21, 2026, not a snapshot archived on the inclusion date. This site’s publication date is shown separately. Check current vendor guidance before acting.

What the vulnerability is

CVE-2026-110936 is an uncontrolled search path element vulnerability (CWE-427) affecting the Siemens Software Center. The flaw allows an authenticated attacker with local access to the system to place a specially crafted Dynamic Link Library (DLL) in a directory that the application searches during execution. If successful, this could lead to arbitrary code execution running with the privileges of the affected application.

Exposure and applicability

This vulnerability is applicable to systems running the Siemens Software Center. In industrial environments, this software is typically deployed on engineering workstations (EWS) or technician laptops used for managing and updating industrial automation software.

Because the attack vector is local and requires authentication, the risk is primarily centered on scenarios where an attacker has already gained a foothold on the workstation or where unauthorized personnel have physical/logical access to these critical support assets. It is not a remote execution vulnerability.

Remediation priorities

Our analysis suggests that asset owners should prioritize the following actions based on the criticality of the affected workstations:

1. Identify Affected Assets: Inventory all engineering workstations and maintenance laptops to determine if the Siemens Software Center is installed and identify the current version.
2. Apply Vendor Mitigations: Implement the mitigations provided by Siemens in accordance with their official security advisories to address the search path flaw.
3. Restrict Local Access: Review and tighten local administrative privileges on EWS and maintenance laptops to reduce the likelihood of an attacker being able to place files in sensitive application directories.
4. Workstation Hardening: Ensure that these systems are isolated from general corporate networks and that only authorized personnel have access, limiting the potential for a local authenticated attacker to exploit the flaw.

How to validate remediation

To verify that exposure has been reduced, OT security leaders and controls engineers should:
* Verify Versioning: Confirm that the installed version of the Siemens Software Center matches the patched or mitigated version specified in the vendor’s guidance.
* Audit Directory Permissions: Review the permissions of the directories used by the Software Center to ensure that non-privileged users cannot write files (such as DLLs) into those paths.

Note: A version check alone does not guarantee total security, but it confirms the application of the vendor’s specific fix for this CVE.

Limits and open questions

It remains unknown whether this vulnerability has been utilized in active ransomware campaigns. Additionally, while CISA has established a remediation deadline of November 3, 2026, for federal agencies, this date is not a mandatory requirement for private sector asset owners, though it serves as a benchmark for risk urgency.

Users should be aware that applying updates to engineering workstations may require coordination with OEM support to ensure compatibility with existing project files and PLC programming software.

Source and editorial note

CVE-2026-110936: Siemens Software Center Uncontrolled Search Path Element Vulnerability · Source date: October 20, 2026 · Retrieved October 21, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Request an OT security assessment