Siemens Software Center
Summary
Siemens Software Center versions prior to 4.0.9.8 are vulnerable to arbitrary code execution due to an uncontrolled search path element. An authenticated local attacker could exploit this by placing a malicious DLL in a searched directory, allowing them to execute code with the application's privileges. Siemens has released an updated version to address this vulnerability.
IFF Assessment
This vulnerability allows for arbitrary code execution by local attackers, posing a direct threat to systems that run Siemens Software Center.
Severity
CISA KEV: Listed as actively exploited. Federal patch due: November 03, 2026. Known ransomware use: Unknown.
Defender Context
This advisory highlights a common vulnerability class (uncontrolled search path element) that can lead to code execution. Defenders should prioritize patching affected Siemens Software Center installations and be aware of the potential for local privilege escalation via DLL planting.