Skip to main content
The Website Services team at NHS England are testing early designs to understand how you find information. Your views will help us check our ideas work. Sign up to take part in our user research.

Active Exploitation of Vulnerability in Siemens Software Center (CVE-2026-110936)

Attackers are abusing Dynamic Link Library (DLL) side-loading in Siemens Software Center to execute malicious code

Threat ID:
CC-4874
Threat Severity:
Medium
Published:
20 October 2026 3:28 PM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Attackers are abusing Dynamic Link Library (DLL) side-loading in Siemens Software Center to execute malicious code

Affected platforms

The following platforms are known to be affected:

Siemens Software Center

  • Versions prior to 4.0.9.8

Threat details

Exploitation of CVE-2026-110936 in the wild

Siemens has confirmed that attackers have exploited the vulnerability by pairing a legitimate, digitally signed copy of Siemens Software Center with malicious DLL files. When the application is executed, the vulnerable software loads the attacker controlled DLL. 

Siemens states that its systems, products and update channels were not breached, with the malicious files instead being supplied separately by the attackers. The NHS England National CSOC assess that future exploitation of this vulnerability is highly likely.

Introduction

Siemens has released a security update to address a high severity vulnerability, CVE-2026-110936, affecting Siemens Software Center. 

  • CVE-2026-110936 - Uncontrolled Search Path Element / DLL side-loading vulnerability - CVSSv4 score: 8.4

Remediation advice

Affected organisations are encouraged to review the Siemens Security Advisory SSA-580366 and apply any relevant updates as soon as possible.

Last edited: 20 October 2026 3:28 pm