Siemens Software Center: 1 CVE, Medium 6.7
Summary
CISA reports 1 vulnerability in Siemens Siemens Software Center. Weakness type: Uncontrolled Search Path Element. The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. Highest CVSS v3 score: 6.7 (Medium), not remotely exploitable per its CVSS vector. At least one CVE is on CISA's Known Exploited Vulnerabilities list.
At a glance
- Vendor
- Siemens
- Products
- Siemens Software Center
- CVEs
- CVE-2026-110936
- Highest CVSS v3
- 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- Yes
- Sectors (per CISA)
- Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities
- Deployed
- Worldwide
- Vendor HQ
- Germany
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-110936 | Uncontrolled Search Path Element | 6.7 | – | Yes (added 2026-10-20) | CVE-2026-110936 |
Affected products (1)
- Siemens Software Center < V4.0.9.8
Vendor fixes and mitigations (from advisory)
- Vendor Fix: Update to V4.0.9.8 or later version (All existing versions of SSC will be auto updated on next startup. The latest version can also be downloaded in the respective link)
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
- CISA advisory ICSA-26-295-03
- Machine-readable CSAF record
- https://cert-portal.siemens.com/productcert/csaf/ssa-580366.json
- https://cert-portal.siemens.com/productcert/html/ssa-580366.html
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.