Anyone running Siemens Software Center older than version 4.0.9.8 should update now. Siemens' advisory SSA-580366 points to active exploitation of a flaw tracked as CVE-2026-110936.
The bug is a DLL-loading problem. A DLL (dynamic-link library) is a shared file of code that an application pulls in while it runs. Here, the application searches an uncontrolled path for those files, so an authenticated local attacker could drop in a specially crafted one. The result is arbitrary code execution with the privileges of the affected application. The weakness is classed as CWE-427, Uncontrolled Search Path Element.
Siemens published the advisory on October 15 and added remediation details on October 17. On October 19 it added a reference to a blog post about active exploitation, and CISA republished the advisory on October 22. Siemens ProductCERT reported the flaw to CISA. The fix is V4.0.9.8 or later, and existing installations update automatically on next startup.
The severity score is the awkward part. The CVSS 3.1 base score is 6.7, rated medium, and the vector explains why: the attacker needs local access and high privileges. That describes the flaw, not the threat. A bug that needs a foothold first is usually a step in a longer chain, and a medium label can push it down a patch queue. Active exploitation is the reason not to let that happen.
The advisory text says to see the blog post for exploitation and detection details but gives no title, author or link for it. It does not say who is exploiting the flaw or how many systems are affected. It does list the sectors where Siemens products are deployed worldwide: critical manufacturing, transportation, energy, healthcare, financial services and government facilities.
That leaves a practical question. Because the update applies on next startup, a machine that rarely restarts the application could stay vulnerable longer than its owner assumes.