# Siemens Software Center DLL flaw exploited

Published: 2026-10-22 · Severity: high · Sectors: Manufacturing, Transportation, Energy, Healthcare, Financial Services, Government (National)
Canonical: https://vorant.io/reports/231ee97d-e0e0-5289-b808-49fa47770862/siemens-software-center-dll-flaw-exploited

> A DLL search-path hijacking bug in Siemens Software Center below 4.0.9.8 is under active exploitation, letting local attackers run arbitrary code.

CISA republished a Siemens ProductCERT advisory (SSA-580366) describing CVE-2026-110936, an uncontrolled search path element (DLL hijacking) vulnerability in Siemens Software Center versions prior to 4.0.9.8. An authenticated local attacker can place a malicious DLL in a directory searched by the application, achieving arbitrary code execution with the privileges of the application process. CVSS v3 base score is 6.7, reflecting the local attack vector and authentication requirement, but Siemens and CISA note that active exploitation of this flaw is known and reference a Siemens blog post with detection guidance, which elevates the practical urgency beyond the base score.

Siemens Software Center is deployed worldwide across critical infrastructure sectors including critical manufacturing, transportation, energy, healthcare, financial services and government facilities. Siemens has released a fixed version (4.0.9.8 or later) and recommends organizations update immediately. Defenders should prioritize patching affected installations, monitor for unauthorized DLL placement in application search paths, and apply standard ICS network segmentation and defense-in-depth practices (isolating control system networks, restricting remote access via VPN) while confirming no unpatched instances remain exposed to untrusted local users.

## Mentioned in this report

- Vulnerabilities: CVE-2026-110936 (KEV)

## Detection guidance (public sample)

### Siemens Software Center Loading Unsigned DLL From Non-Standard Location

ATT&CK: T1574.001

Siemens Software Center process loading an unsigned DLL from outside Windows or Program Files paths, consistent with DLL search-path hijacking (CVE-2026-110936). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Siemens Software Center Loading Unsigned DLL From Non-Standard Location
description: Detects a Siemens Software Center process loading an unsigned DLL from
  a location outside the Windows and Program Files directories. This matches the DLL
  search-path hijacking behaviour described for CVE-2026-110936. The process name
  is matched loosely because the advisory gives no file names. Requires Sysmon-style
  image load telemetry with the Signed field.
tags:
- attack.persistence
- attack.privilege-escalation
- attack.stealth
- attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|contains: SoftwareCenter
    ImageLoaded|endswith: .dll
    Signed: 'false'
  filter_trusted_paths:
    ImageLoaded|startswith:
    - C:\Windows\
    - C:\Program Files\
    - C:\Program Files (x86)\
  condition: selection and not filter_trusted_paths
falsepositives:
- Unsigned plugin or extension DLLs deployed by an engineering team next to the application
  in a custom directory
- Siemens software updates that stage unsigned helper DLLs in a temporary folder during
  installation
level: medium
id: aad6e278-9770-5305-ae9a-2a7fdc240347
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-03
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-03

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/231ee97d-e0e0-5289-b808-49fa47770862/siemens-software-center-dll-flaw-exploited.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup