Siemens Software Center DLL Hijacking Vulnerability (CVE-2026-110936) - Arbitrary Code Execution

The primary remediation is to apply the vendor-provided security update.

1. Software Update

• Upgrade to Siemens Software Center V4.0.9.8 or a newer version via the Siemens Industry Online Support portal.

2. Temporary Mitigations

• Restrict Directory Permissions: Ensure that standard users do not have write access to the application's installation directory or any directories included in the system PATH.
• Enable Safe DLL Search Mode: Ensure SafeDllSearchMode is enabled in the Windows Registry to prioritize system directories over the current working directory.

reg query "HKLM\System\CurrentControlSet\Control\Session Manager" /v SafeDllSearchMode

• Endpoint Monitoring: Use EDR solutions to detect and block the loading of unsigned or suspicious DLLs from non-standard locations.

This vulnerability is a classic CWE-427 (Uncontrolled Search Path Element) flaw, commonly known as DLL Hijacking. The Siemens Software Center fails to properly validate or restrict the search paths used when loading dynamic-link libraries (DLLs). An authenticated local attacker can exploit this by placing a malicious DLL file in a directory that the application searches before the legitimate system directories. When the application starts, it loads the attacker's DLL, leading to arbitrary code execution within the security context of the application. Given its inclusion in the CISA KEV catalog and a high EPSS score of 0.94, this vulnerability is being actively exploited in the wild and poses a significant risk to industrial and engineering environments.