Siemens has disclosed a high-severity vulnerability affecting Siemens Software Center that could allow authenticated local attackers to execute arbitrary code through malicious dynamic-link library (DLL) files.
The vulnerability, tracked as CVE-2026-110936, carries a CVSS v4.0 score of 8.4 and affects Siemens Software Center. The flaw stems from an uncontrolled DLL path, potentially allowing authenticated local attackers to place specially crafted DLL files in directories searched by the application, leading to arbitrary code execution with the application's privileges.
Apply vendor-recommended patches and mitigations in accordance with vendor instructions, ensuring alignment with NCSA’s Qatar National Vulnerability Management Guidelines, Version 1.0 including its risk-based prioritization and Reference SLA Matrix. Stakeholders are responsible for evaluating the affected asset’s criticality and internet exposure, prioritizing remediation accordingly, and ensuring that vulnerabilities are remediated within the applicable NCSA timeframe. Where immediate remediation is not feasible, the vulnerability should be formally tracked and managed through the organization’s vulnerability and risk management process until remediation is completed.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
