CISA Adds Exploited Siemens Software Center Flaw to KEV
Tech GuruQuick Answer
CISA added Siemens Software Center CVE-2026-110936 to KEV after Siemens confirmed active exploitation. Preserve endpoint evidence, verify software provenance, investigate Siemens' host and network indicators, and update affected installations to 4.0.9.8 or later.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory Siemens Software Center installations and provenance; preserve volatile, host, and network evidence; investigate the authority indicators; contain suspected compromise; update to 4.0.9.8 or later from Siemens; and validate the resulting installation.
Last verified: 2026-10-21 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Siemens Software Center |
|---|---|
| Advisory | SSA-580366 / CISA KEV: CVE-2026-110936 |
| CVE | CVE-2026-110936 |
| Original authoritative release date | 2026-10-15 (Siemens publishes the date without a time) |
| Latest material revision / CISA KEV addition | October 20, 2026 at 19:00:31 UTC |
| Affected versions | All versions before 4.0.9.8. |
| Fixed version | 4.0.9.8 or later |
| CVSS base score | 6.7 (CVSS v3.1) / 8.4 (CVSS v4.0) |
| CVSS severity | Medium (CVSS v3.1) / High (CVSS v4.0) |
| Exploitation status | Siemens and CISA confirm evidence of active exploitation; known ransomware campaign use is unknown.; no exploitation claim is inferred. |
What Changed
Siemens reports confirmed active exploitation involving a genuine signed Software Center executable distributed with malicious DLLs outside Siemens channels; Siemens says its systems, products, and update channel were not breached. CISA added the CVE to KEV on October 20 with a November 3 due date for in-scope federal systems.
What To Validate Now
- Inventory. Identify Siemens Software Center installations, versions, acquisition source, installation path, DLL inventory, owner, and relevant endpoint and network telemetry.
- Establish applicability. Treat versions before 4.0.9.8 as affected and determine whether the installation bundle and DLLs came from an official Siemens source. Do not infer applicability or bundle integrity from a valid Siemens signature alone.
- Remediate. Preserve volatile and host evidence, investigate the Siemens indicators, contain suspected compromise, and install Software Center 4.0.9.8 or later from an official Siemens channel.
- Validate. Confirm the resulting version and source, validate normal application and update behavior, review host and network indicators, and document incident, containment, credential, and rebuild decisions.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
The campaign used a genuine signed Siemens executable with attacker-supplied DLLs, so the Siemens file signature alone does not prove a bundle is safe. CISA's November 3 due date applies to in-scope federal systems. Use current indicators in context and preserve evidence before cleanup.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
