[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-siemens-software-center-bug-exploited-fixed-in-4098":10,"sections":45},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":34,"tags":35,"sources":40,"feedback":44,"feedback_at":22,"cost_usd":44,"total_tokens":44},12195,"siemens-software-center-bug-exploited-fixed-in-4098","Siemens Software Center Bug Exploited, Fixed in 4.0.9.8","A 6.7-rated DLL-loading flaw in Siemens Software Center is reportedly being exploited, and the fix is already shipping through auto-update.","Anyone running Siemens Software Center older than version 4.0.9.8 should update now. Siemens' advisory SSA-580366 points to active exploitation of a flaw tracked as CVE-2026-110936.\n\nThe bug is a DLL-loading problem. A DLL (dynamic-link library) is a shared file of code that an application pulls in while it runs. Here, the application searches an uncontrolled path for those files, so an authenticated local attacker could drop in a specially crafted one. The result is arbitrary code execution with the privileges of the affected application. The weakness is classed as CWE-427, Uncontrolled Search Path Element.\n\nSiemens published the advisory on October 15 and added remediation details on October 17. On October 19 it added a reference to a blog post about active exploitation, and CISA republished the advisory on October 22. Siemens ProductCERT reported the flaw to CISA. The fix is V4.0.9.8 or later, and existing installations update automatically on next startup.\n\nThe severity score is the awkward part. The CVSS 3.1 base score is 6.7, rated medium, and the vector explains why: the attacker needs local access and high privileges. That describes the flaw, not the threat. A bug that needs a foothold first is usually a step in a longer chain, and a medium label can push it down a patch queue. Active exploitation is the reason not to let that happen.\n\nThe advisory text says to see the blog post for exploitation and detection details but gives no title, author or link for it. It does not say who is exploiting the flaw or how many systems are affected. It does list the sectors where Siemens products are deployed worldwide: critical manufacturing, transportation, energy, healthcare, financial services and government facilities.\n\nThat leaves a practical question. Because the update applies on next startup, a machine that rarely restarts the application could stay vulnerable longer than its owner assumes.","[\"siemens\",\"vulnerability\",\"ics\",\"active-exploitation\"]","2026-10-22T12:00:00.000Z","2026-10-22T19:32:33.939Z","2026-10-22T19:32:34.245Z","published",null,[24,30],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"The article leans on an unnamed 'blog post on known active exploitation' that the reader cannot find, and it never says who published it, what it is called, or that the source gives no link, so either name and identify it or state plainly that the advisory doesn't link it; also say up front that 'the advisory' is Siemens' SSA-580366 as republished by CISA (initial CISA republication Oct 22), so the exploitation claim is clearly attributed and cold readers know which document is meant.","resolved",{"id":31,"reviewer":26,"round":32,"reason":33,"status":29},"editor-r2",2,"The draft now attributes the exploitation claim to Siemens' SSA-580366 as republished by CISA and says the blog post has no title, author or link, but the CISA identifier 'ICSA-26-295-03' appears nowhere in the source material, so remove it (or refer only to SSA-580366 and CISA's October 22 republication) and keep everything else.","security",[36,37,38,39],"siemens","vulnerability","ics","active-exploitation",[41],{"name":42,"url":43},"CISA Advisories","https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fics-advisories\u002Ficsa-26-295-03",0,{"sections":46},[47,52,56,61,66,71,76,81,86,91,96,101,106,111],{"name":48,"slug":49,"count":50,"latest_published_at":51},"AI","ai",7065,"2026-10-22T21:51:25.000Z",{"name":53,"slug":34,"count":54,"latest_published_at":55},"Security",1057,"2026-10-22T15:11:26.000Z",{"name":57,"slug":58,"count":59,"latest_published_at":60},"Policy","policy",574,"2026-10-22T20:23:48.000Z",{"name":62,"slug":63,"count":64,"latest_published_at":65},"Deals","deals",559,"2026-10-22T21:00:00.000Z",{"name":67,"slug":68,"count":69,"latest_published_at":70},"Hardware","hardware",288,"2026-10-22T17:25:00.000Z",{"name":72,"slug":73,"count":74,"latest_published_at":75},"Consumer Tech","consumer-tech",285,"2026-10-22T22:21:59.000Z",{"name":77,"slug":78,"count":79,"latest_published_at":80},"Science","science",215,"2026-10-22T16:37:00.000Z",{"name":82,"slug":83,"count":84,"latest_published_at":85},"Startups","startups",143,"2026-10-22T18:38:47.000Z",{"name":87,"slug":88,"count":89,"latest_published_at":90},"Software","software",141,"2026-10-22T20:02:35.000Z",{"name":92,"slug":93,"count":94,"latest_published_at":95},"Dev Tools","dev-tools",122,"2026-10-21T16:00:00.000Z",{"name":97,"slug":98,"count":99,"latest_published_at":100},"General","general",97,"2026-10-22T21:05:05.000Z",{"name":102,"slug":103,"count":104,"latest_published_at":105},"Gaming","gaming",87,"2026-10-22T18:14:24.000Z",{"name":107,"slug":108,"count":109,"latest_published_at":110},"Reviews","reviews",38,"2026-10-20T12:00:00.000Z",{"name":112,"slug":113,"count":114,"latest_published_at":115},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]