CISA has added a Siemens Software Center flaw to its Known Exploited Vulnerabilities (KEV) catalogue, giving US federal agencies until 3 November 2026 to fix it. The flaw, tracked as CVE-2026-110936, affects all versions of Siemens Software Center before V4.0.9.8, and Siemens has confirmed active exploitation.

What the flaw is

Siemens Software Center is the application customers use to download, install, activate and update purchased Siemens software. The flaw is an uncontrolled search path weakness: the application can load dynamic-link libraries from a directory an attacker controls, leading to code running with the application’s privileges. Siemens scores it 8.4 under CVSS v4.0 (6.7 under v3.1), and published advisory SSA-580366, crediting Jose Oregon of Huntress Labs with reporting it.

Why it reaches beyond Siemens customers

Siemens says attackers chose the program as a carrier because it is signed and trusted, shipping a genuine copy alongside their own malicious files outside official channels. That means a machine can be affected even if the organisation never deployed Siemens software — Siemens lists the program appearing in start-up apps or Task Scheduler on a PC that never had it installed as a warning sign. Siemens stresses that no Siemens system, product or update channel was breached, to its knowledge.

What to do

Siemens says existing installations will auto-update to V4.0.9.8 on next start-up, and users should check every copy is on that version or later and hunt for the indicators Siemens published. CISA lists known ransomware use of the flaw as unknown, and its deadline binds federal agencies — but the KEV listing is the signal every other organisation uses to prioritise.