Siemens Software Center Uncontrolled Search Path Element Vulnerability

Siemens Software Center

Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application. Added to CISA KEV on 2026-10-20 (federal deadline 2026-11-03).

First seen: 20 Oct 2026
Last update: 20 Oct 2026, 12:00 UTC
Identifiers: CVE-2026-110936
CVSS: 8.4
Source: CISA KEV

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Siemens Software Center Uncontrolled Search Path Element Vulnerability
Severity: high, exploited in the wild. Patch status: patched.
Affected: Siemens Software Center
Ids: CVE-2026-110936

Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application. Added to CISA KEV on 2026-10-20 (federal deadline 2026-11-03).

## Steps
1. Search the repo, its CI and infra config for Siemens Software Center. If present, report the version in use and whether it's affected.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-110936") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://nvd.nist.gov/vuln/detail/CVE-2026-110936 https://productcert.siemens.com/productcert/html/ssa-580366.html
https://pwned.coffee/i/siemens-software-center-uncontrolled-search-path-element-cve-2026-110936

Sources

Totalone hot coffee