CVE-2026-110936: CWE-427: Uncontrolled Search Path Element in Siemens Siemens Software Center

This vulnerability (CWE-427) in Siemens Software Center involves an uncontrolled search path element for dynamic-link libraries (DLLs). Because the application loads DLLs from directories that are not securely controlled, an authenticated local attacker could place a specially crafted DLL in one of these directories. When the application loads this malicious DLL, it could execute arbitrary code with the privileges of the affected application. The CVSS 3.1 base score is 6.7, reflecting local attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An authenticated local attacker can achieve arbitrary code execution with the privileges of the Siemens Software Center application. This could lead to full compromise of the application and potentially the system depending on the application's privilege level.

No official patch or remediation information is provided in the vendor advisory or CVE data. Patch status is not yet confirmed — check the Siemens vendor advisory for current remediation guidance. Until a fix is available, restrict local access to trusted users only and monitor for suspicious activity related to DLL loading.