CVE-2026-110936 explained: the Siemens Software Center flaw and how to fix it

The two-minute check

1. Open Siemens Software Center on the computer where it's installed.
2. Look in the About or Help menu for the version number.
3. Compare it against V4.0.9.8. Anything earlier is covered by this record.
4. If you can't find the program anywhere, it likely isn't installed on that machine.

When you can stop reading

If Siemens Software Center isn't installed on any computer, phone, or server your business uses, this vulnerability doesn't apply to you. The record names only this one Siemens product as affected. No other software is in scope here, so you can close this tab.

What the official record says

This flaw gets a Common Vulnerability Scoring System (CVSS) score of 6.7, rated MEDIUM, according to the National Vulnerability Database (NVD). The scoring details show an attacker needs to already be logged in with high-level access on that specific machine. No one has to click anything, but the attacker can't reach this over the network from somewhere else.

The root cause is a bug where the program searches for a required file, a dynamic-link library (DLL), across several folders without confirming each one is trustworthy. An attacker with local access can plant a fake file in one of those folders so the program loads it instead. That file then runs with whatever permissions Software Center has.

This flaw is also on the Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalog, added on 2026-10-20. That listing means it's already being used in real attacks, not just a theoretical risk.

The Exploit Prediction Scoring System (EPSS) puts the chance of exploitation at 0.24%, around the 14th percentile, according to NVD. That's a low chance of exploitation in the next 30 days, and EPSS forecasts near-term activity rather than measuring how severe the flaw is.

What that means for a business like yours

A MEDIUM score with a local, authenticated attack path means a random stranger on the internet can't trigger this directly. The realistic risk is an attacker who already has some foothold on a machine, maybe through a shared login or a prior phishing success, using this flaw to take full control of that system. Because CISA confirms it's already being exploited somewhere, applying the vendor's fix is worth doing rather than putting off.

If someone else manages your IT

Send this to your provider. Ask them to confirm each step in writing.

• "Please check whether we run Siemens Software Center."
• "If we do, please tell me the version number."
• "Please apply the Siemens patch for CVE-2026-110936."
• "Please confirm once it's installed and verified."

If you don't have an in-house IT team, a managed IT services provider backed by a dedicated cybersecurity team can run this check and apply the fix for you.

If you manage it yourself

1. Open Siemens Software Center and check the version in the About screen.
2. If it's older than V4.0.9.8, go to the Siemens advisory for the current version.
3. Download the update from that page.
4. Run the installer and follow the vendor's prompts.
5. Restart the computer once installation finishes.
6. Repeat this on every computer that has Siemens Software Center installed.

This flaw is on the CISA Known Exploited Vulnerabilities catalog, which confirms active exploitation rather than just possible risk. Federal agencies have a due date of 2026-11-03 to fix it, under CISA's KEV catalog rules. Your business doesn't answer to that federal deadline, but the honest answer is still now. A patch exists, and attackers are already using this somewhere.

If your business falls under rules like the FTC Safeguards Rule or HIPAA, promptly patching known-exploited flaws is typically part of those obligations too.

Don't trust the installer's success message on its own. Reopen Siemens Software Center once the update finishes. Check the About or Help screen again. Confirm the version now reads V4.0.9.8 or newer. If it still shows an older number, run the installer again or ask your IT provider to check it.

If you can't patch immediately, a few steps lower your exposure without closing the gap completely.

• Limit who has administrator rights on machines running Siemens Software Center. This shrinks the pool of people who could plant a malicious file, though it doesn't fix the underlying flaw.
• Tighten account privileges with a privileged access management approach, so fewer logins carry the elevated rights this attack needs.
• Watch affected machines with endpoint detection and response (EDR) tools. They can flag unusual file activity even though they won't block this specific flaw.
• Schedule the real update as soon as you can. None of these steps replace the vendor's patch.

Do I have to do anything if we only use this at home?

The record describes Siemens Software Center as running on a computer, phone, or server. If it's installed anywhere you're responsible for, including a home-office machine used for work, the same check and patch applies there too.

Will this break anything?

The record doesn't say. Vendor updates occasionally change settings or require a restart. Test on one machine first if you're able to, and keep your IT provider informed.

Does this affect other Siemens software we use?

The record names only Siemens Software Center as affected. If you use other Siemens products, check with the vendor separately, since this advisory doesn't cover them.

What if we don't know whether we have Siemens Software Center installed?

Ask whoever manages your computers, or run the two-minute check above on a sample of machines. A free IT assessment can also confirm what's installed across your business.

Is this the kind of thing a firewall stops?

Not really. The attack needs local access to the machine itself, not a network connection, so a firewall alone won't block it. Limiting who can log in and keeping software patched matters more here.

If you want help checking every machine across your business, contact LayerLogix or start with a free IT assessment. LayerLogix offers 20+ years of experience and 100% U.S.-based support, with business-hours support and after-hours emergency response.