Summary
generated automatically from NVD dataSiemens Software Center versions before V4.0.9.8 are affected by an uncontrolled DLL search path flaw (CWE-427). An authenticated local attacker could place a crafted DLL in a directory the application searches, causing arbitrary code execution with the application's privileges. The issue carries a CVSS v3.1 score of 6.7 (MEDIUM) and is listed in the CISA KEV catalog, which indicates active exploitation.
NVD description
A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.
⚠️ Actively exploited — CISA KEV
This CVE was added to CISA's Known Exploited Vulnerabilities catalog on 2026-10-20. It is confirmed exploited in the wild and must be patched as a priority.
Remediation deadline (US federal agencies): 2026-11-03
EPSS · FIRST.org
0.14%probability of exploitation in the next 30 days
Higher than 2% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-20, recomputed daily by FIRST.org.
In-depth analysis on cveo.tech
We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.
CVSS v3.1 Score
Information
- Published
- 15 oct. 2026
- Updated
- 21 oct. 2026
- Status
- Undergoing Analysis
- Source
- productcert@siemens.com
Weaknesses (CWE)
Similar CVEs
Other vulnerabilities of type CWE-427
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.