Page generated: 06 Nov 2026, 03:50 UTC
← Dashboard

CVE-2026-110936

A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a director…

Read full description
A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.
CVSS 6.7 (MEDIUM) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
4.0/10
REALITY · THREAT PRIORITY
8.0/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 6.7: +1.01
  • Fresh EPSS: 0.97%: +0.00

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 10 documents and public datasets.

Hype components

Headline sample (25%)
40/100
Press, 30 days (60%)
50/100
Grounded branding (15%)
0/100
HYPE TOTAL40/100

Sources and documents

Rescana
Press · 22 Oct 2026, 13:45 · Siemens Software Center CVE-2026-110936: Exploited DLL Side-Loading Flaw Added to CISA KEV. Update to 4.0.9.8 - Rescana
Howl.link
Press · 21 Oct 2026, 20:10 · CISA Warns of Active Exploitation of Plex2Shell and Other Flaws · cyber.hendryadrian.com - Howl.link
The Hacker News
Press · 21 Oct 2026, 07:00 · CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws - The Hacker News
Howl.link
Press · 21 Oct 2026, 06:08 · CISA Adds Six Actively Exploited Vulnerabilities to KEV Catalog · cyber.hendryadrian.com - Howl.link
Howl.Link
Press · 20 Oct 2026, 20:49 · Siemens Patches Software Center DLL Sideloading Flaw Exploited in ClickFix Attacks · cyber.hendryadrian.com - Howl.Link
See all 10 source documents
SOC Prime
Press · 20 Oct 2026, 13:59 · CVE-2026-110936: Siemens Software Center Zero-Day - SOC Prime
Help Net Security
Press · 20 Oct 2026, 12:23 · Attackers exploit Siemens Software Center flaw in active ClickFix malware campaign - Help Net Security
The Hacker News
Press · 20 Oct 2026, 07:00 · ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan - The Hacker News
TechNadu
Press · 20 Oct 2026, 07:00 · Siemens Software Center Flaw CVE-2026-110936 Under Active Attack: Update Now - TechNadu
SecurityWeek
Press · 19 Oct 2026, 07:00 · Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks - SecurityWeek

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 4.0 · reality 8.0 (2026-11-02 15:14). The curve appears once the score changes.

Public exploit evidence

0

Public exploit entries / repo candidates

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 6.7; EPSS 1.0%
Attention, last 30 days
10 distinct story titles; 10 press documents; 1 publisher domains.
Technical potential
local access, high privileges, no user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:59:53.577903+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
Published
15 Oct 2026, 14:01
First press mention
19 Oct 2026, 07:00
Added to the CISA KEV catalog
20 Oct 2026, 00:00
Latest press mention
22 Oct 2026, 13:45
Score calculated
05 Nov 2026, 13:59