Siemens security advisory (AV26-1063) – Update 1
At a glance
- Severity
- Critical
- Used in attacks
- Yes, 1 of 1 flaw named
- Flaws named
- CVE-2026-110936
- Industries
- Government
- Reported by
- 1 outlet
As of October 15, 2026, Siemens is affected by a vulnerability in the following product:
- Siemens Software Center
- Prior to V4.0.9.8
Update 1
On October 20, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-110936 to their Known Exploited Vulnerabilities (KEV) Database.
Siemens has reported that CVE-2026-110936 is being exploited in the wild.
The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
Originally published by Canadian Centre for Cyber Security. © Canadian Centre for Cyber Security. Written by Canadian Centre for Cyber Security.
Vulnerabilities referenced
- CVE-2026-110936Not scored yet
Siemens Software Center
Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.
Used in attacksAdded to CISA's list 2026-10-20
Full record →
Fastnexa security experts
This story involves a flaw attackers are already using. Are you exposed?
A Fastnexa penetration tester can check whether CVE-2026-110936 or anything like it can be used against your websites, apps and network.
Think you’ve already been hit? Don’t wait on a form: call or WhatsApp +1 (732) 454 2616. We reply within 1 hour, 24/7. Emergency help →
Coverage
One outlet has carried this so far.
2026-10-20 19:57 UTC
Related stories
- China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack
The Hacker News · 2026-10-22
- PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk
The Register · 2026-10-21
- Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
The Hacker News · 2026-10-21
- CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers
BleepingComputer · 2026-10-21
- Oracle Corporation security advisory (AV26-1071)
Canadian Centre for Cyber Security · 2026-10-21