CISA added CVE-2026-110936 to its Known Exploited Vulnerabilities (KEV) catalogue on 20 October 2026. The vulnerability affects Siemens Software Center and is an uncontrolled search path element flaw that could let an authenticated local attacker execute arbitrary code with the application’s privileges.
The flaw allows an attacker to place a specially crafted DLL in a directory searched by the application. If the application loads it, the attacker can execute code with the privileges of the affected application. The CVSS score is 8.4, rated HIGH. Patch availability is listed as unknown; Siemens has published information about the vulnerability at its product security advisory page.
KEV inclusion indicates that CISA has confirmed active exploitation. The supplied data does not confirm whether attackers have used the vulnerability in ransomware campaigns. CISA’s remediation deadline is 3 November 2026.
CISA requires agencies to “apply mitigations in accordance with vendor instructions”, following applicable BOD 26-04 guidance and CISA’s Forensics Triage Requirements. For cloud services, organisations should follow applicable BOD 26-04 guidance; if mitigations are unavailable, they should discontinue use of the product. Federal Civilian Executive Branch (FCEB) agencies are directly affected by CISA’s requirements.
All organisations should review their Siemens Software Center exposure, assess each asset’s internet exposure and prioritise remediation in line with applicable guidance.
See the [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-110936) and [CISA KEV catalogue](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) for full details.