CVE-2026-110936

CWE-427

Final Priority

High

Raised from Low (raw RPS) by the KEV floor: in CISA KEV

46.5

Raw RPS

Description

A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.

Source: NVD

CVSS: 6.7; Medium · v3.1
EPSS: 0.23%; Probability of exploitation in the next 30 days (FIRST) · Percentile: 13.9%
CISA KEV: In CISA KEV since Oct 2026; Confirmed exploitation in the wild (CISA KEV)
Upstream fix commit: No verified fix commit in DevSecure data; Sources: MoreFixes, FreshFixes
SSVC inputs (CISA): Exploitation: Active · Automatable: No · Technical impact: Total; CISA's assessed SSVC inputs, not a decision. A decision also needs your mission and public well-being context. Context only; not part of the RPS score.
Weakness: CWE-427
Published: 15 Oct 2026; Last modified 21 Oct 2026

How to read these signals: RPS · EPSS · CISA KEV · Data sources

What would change this priority?

•Stays at least High while it is in CISA KEV (KEV floor).

Explains the published RPS formula and priority rules; it doesn't change the score. How priority works

Get this score from the API

curl -H "Authorization: Bearer dsec_live_xxxxxxxx" \
  https://api.intelligence.devsecure.io/api/v1/rps/CVE-2026-110936

Replace the placeholder with your key. Get a free API key or rank your own CVEs.

Data as of 23 Oct 2026, 05:17 UK time

This product uses the NVD API but is not endorsed or certified by the NVD. Data sources and licences

CVE-2026-110936

Description

Signals

What would change this priority?

Get this score from the API