TLP:CLEARSECURITY ADVISORYHRK-SA-2026-1104-23Exploited in the wild
Siemens Software Center hijack (CVE-2026-110936): a search-path flaw in the tool that installs your software
An uncontrolled search path element in Siemens Software Center lets a malicious file placed on the search path run with the application’s privileges. It is exploited in the wild and listed in CISA KEV. The tool that distributes and updates engineering software becomes the delivery mechanism for an attacker. Patch to the fixed version, clean the search path, and validate on the engineering hosts that run it.
SEVERITY
High
PEAK CVSS
n/a
AUTH REQUIRED
Local
PUBLIC POC
Reported
PUBLISHED
Nov 4, 2026
REVISION
v1.0 · @Melly
Hayrok Research highlight
The software that keeps your other software updated is a privileged, trusted process that runs quietly in the background. Subvert it and your patching tool becomes your attacker’s delivery van.
CVE-2026-110936 is an uncontrolled search path element in Siemens Software Center, the client that installs and updates Siemens engineering applications. If an attacker can place a malicious library or binary where the application looks first, that file runs with the Software Center’s privileges. It is exploited in the wild and CISA has added it to the Known Exploited Vulnerabilities catalog.
This is a supply-chain foothold with a local flavor: it lands on engineering workstations and OT-adjacent hosts, the machines that bridge IT and the plant floor and are often the least aggressively patched. An attacker who gets code running inside a trusted updater inherits its reach and its credibility. Search-path flaws are quiet by nature, there is no dramatic exploit, just a file in the wrong place that the right process trusts, which is exactly why they need validation rather than a glance at a severity score.
01 · EXECUTIVE SUMMARY
Bottom line
Hayrok Research Lab is tracking an exploited uncontrolled search path element in Siemens Software Center, the client used to install and update Siemens engineering software. A malicious file on the search path runs with the application’s privileges, turning a trusted updater into a code-execution path. CISA added CVE-2026-110936 to KEV. The risk concentrates on engineering workstations and OT-adjacent hosts. Patch to the fixed version, remove writable directories from the search path, and validate on the hosts that run it.
KEY JUDGMENTS
01
CISA added CVE-2026-110936 to its KEV catalog after evidence of active exploitation, alongside other exploited flaws in the same update cycle.Observed
02
The impact is code execution with the Software Center’s privileges, abusing the trust placed in a software distribution and update tool.Assessed
03
Exploitation requires placing a file where the application searches first, so a writable search-path directory on an affected host is the enabling condition.Reproduced
04
Siemens Software Center runs on engineering and OT-adjacent workstations, the IT/OT bridge hosts that are typically patched least aggressively.Assessed
02 · VULNERABILITY DETAILS
Vulnerability summary
Siemens Software Center uncontrolled search path element
DisclosureSiemens ProductCERT publishes an advisory and fixed Software Center version for CVE-2026-110936.
ExploitationCISA adds CVE-2026-110936 to KEV after evidence of active exploitation, alongside other exploited flaws in the same window.
ContextSearch-path hijacks are quiet and reliable, which makes them attractive against the under-patched IT/OT bridge.
04 · AFFECTED PRODUCTS
Affected and fixed versions
Exposure is any host running an affected Software Center version with a writable directory on its search path. Confirm the exact affected and fixed versions against the Siemens ProductCERT advisory.
ITEM
AFFECTED
FIXED IN
STATUS
Siemens Software Center
below the fixed version
fixed version per Siemens advisory
Fixed
Engineering workstations
SSC installed, old version
update and clean the search path
Priority
OT-adjacent / IT-OT bridge hosts
least aggressively patched
find and update
Higher risk
SSC on the fixed version
search path clean
not affected
Fixed
CONFIRM IN THE ADVISORYThe affected version range and the fixed Software Center release come from the Siemens ProductCERT advisory. Confirm them there, and record the fixed version you deployed per host.
05 · RECOMMENDED ACTIONS
What to do, in priority order
CriticalImmediately
Engineering and OT-adjacent hosts with SSCUpdate to the fixed Software Center version and remove writable directories from the search path.
Hosts with any sign of tamperingTreat planted libraries or binaries as a foothold and investigate.
HighWithin the patch window
All Software Center installsFind and update every instance, including on the IT/OT bridge.
Search-path hygieneEnsure the application loads only from trusted, non-user-writable directories.
MonitoringAlert on the Software Center process loading unexpected modules or spawning processes.
HighBefore closing
Every hostRecord the SSC version, search-path review and any clean-up as evidence.
WORKAROUNDS
Update Software Center. Apply the fixed version from the Siemens advisory. This is the durable fix.Clean the search path. Remove user-writable directories from the application’s search path so planted files cannot be loaded.Restrict local access. Limit who can write to the relevant directories on engineering hosts.Monitor module loads. Alert when the Software Center loads unexpected libraries or launches child processes.
06 · DETECTION AND HUNTING
Observables and hunting queries
Search-path hijacks leave little noise, so hunt on the version, on writable search-path directories, and on unexpected module loads by the updater.
TYPE
OBSERVABLE
SOURCE
Exposure
A Software Center version below the fixed release
Software inventory, host review
Exposure
A user-writable directory on the application’s search path
Filesystem and path review
Behavior
The Software Center process loading an unexpected library or spawning a process
# review the SSC search path for directories a non-admin user can write to
HUNT · CVE-2026-110936unexpected module loads
# EDR: Software Center process loading non-Siemens libraries or spawning children
07 · MITRE ATT&CK
Technique mapping
TACTIC
ID
TECHNIQUE
BASIS
Execution
T1574.007
Hijack Execution Flow: Path Interception by PATH Environment Variable
Observed
Privilege Escalation
T1574
Hijack Execution Flow
Assessed
08 · TECHNICAL ANALYSIS
Root cause and attack path
CVE-2026-110936 is an uncontrolled search path element (CWE-427) in Siemens Software Center, the client that installs and updates Siemens engineering applications. When the application resolves a library or executable, it searches a sequence of directories. If any directory the application checks before the legitimate one is writable by an attacker, a malicious file placed there is loaded and run with the application’s privileges. The flaw is local, but the payoff is execution inside a trusted, privileged updater.
That trust is the whole risk. A software distribution tool is expected to fetch and run code, is often allow-listed, and runs on the engineering workstations and OT-adjacent hosts that bridge corporate IT and the plant floor, the machines usually patched least aggressively. An attacker who subverts it inherits its reach and its credibility, which is why CISA listed it as exploited. Search-path hijacks produce no dramatic exploit artifact, only a file in the wrong place that the right process trusts, so the defensive answer is to patch, remove writable directories from the search path, and validate on the specific hosts that run the tool.
01 ACCESS
Attacker can write to a search-path directory on the host
Control: Restrict local write access to those paths
02 PLANT
A malicious library or binary is placed on the path
Control: Remove writable dirs from the search path
03 LOAD
Software Center loads the file before the legitimate one
Control: Update to the fixed Software Center version
04 EXECUTE
Code runs with the updater’s privileges on an OT-adjacent host
OS command injection in a WAF product, confirmed exploited and added to KEV in the same window.
AssessedWhen the tool that installs your software is the attack, trust is the vulnerability. Search-path flaws on the IT/OT bridge are quiet, exploited, and exactly what validation is for.
09 · VALIDATION
Confirm remediation
A version number alone is not a verdict for a search-path flaw. Each host should end with evidence: on the fixed version, with no user-writable directory on the application’s search path.
01
Inventory Software Center installs
Across engineering and OT-adjacent hosts.
# enumerate hosts running Siemens Software Center and record the version
02
Confirm the fixed version
Compare against the Siemens ProductCERT fixed release.
# compare the SSC version to the Siemens advisory fixed version
03
Review the search path
Find any directory the app searches that a non-admin user can write to.
# list the application search path and check each directory's write permissions
04
Check for planted files
Look for unexpected libraries or binaries in search-path directories.
# inspect search-path directories for non-Siemens or recently added modules
05
Confirm detection
Ensure module-load and child-process alerts for the updater are live.
# verify EDR alerts on SSC loading unexpected libraries or spawning processes
10 · EXPOSURE SELF-ASSESSMENT
Am I exposed?
CVE-2026-110936
01Do you run Siemens Software Center on any engineering or OT-adjacent hosts?
02Is any install below the fixed Software Center version in the Siemens advisory?
03Does the application’s search path include any directory a non-admin user can write to?
04Would your monitoring catch the Software Center loading an unexpected library?
ANSWER TO SEE A VERDICT
Pick yes, no or not sure for each question.
11 · REFERENCES AND REVISION HISTORY
References
›Siemens ProductCERT advisory for CVE-2026-110936
›CISA Known Exploited Vulnerabilities catalog (CVE-2026-110936)
›NVD: CVE-2026-110936
›BleepingComputer: CISA flags Siemens Software Center and other exploited flaws
This advisory will be updated as exploitation activity or vendor guidance changes.
12 · FAQ
Is CVE-2026-110936 being exploited?
Yes. CISA added it to the KEV catalog after evidence of active exploitation, alongside other exploited flaws in the same window.
What does the flaw do?
It is an uncontrolled search path element: a malicious file placed where the Software Center searches first runs with the application’s privileges.
Who is most at risk?
Engineering workstations and OT-adjacent hosts that run Siemens Software Center, which bridge corporate IT and the plant floor and are often patched least aggressively.
How do we fix it?
Update Software Center to the fixed version in the Siemens advisory and remove any user-writable directory from the application’s search path.
VALIDATE YOUR EXPOSURE
Prove your IT/OT bridge exposure
Hayrok finds Software Center installs on engineering and OT-adjacent hosts, confirms the fixed version, and checks the search path for writable directories an attacker could abuse. Every result lands in Evidence Fabric.