Siemens Software Center DLL Sideloading via Uncontrolled Search Path
Siemens Software Center before V4.0.9.8 loads DLLs from an uncontrolled search path, allowing a local attacker to execute code with the application's privileges. Exploited in the wild via ClickFix lures.
- Vendor
- Siemens
- Product
- Siemens Software Center (versions before V4.0.9.8)
- CVSS
- 6.7
- EPSS (exploit probability)
- 0.1%
- Status
- exploited-in-wild
- Published
Is CVE-2026-110936 being exploited?
Yes, per ENISA's EU Vulnerability Database (EUVD) exploited list. It was not on CISA's KEV catalog as of our 2026-10-20 snapshot.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.1% (scored October 19, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ LISTED ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-20. Full cross-catalog view: /kev-comparison
Siemens Software Center versions before V4.0.9.8 load dynamic-link libraries (DLLs) from an uncontrolled search path. An attacker who can place a crafted DLL in the directory from which the application runs can have that DLL loaded and executed with Software Center’s privileges.
The vulnerability has been combined with ClickFix social-engineering lures in an active campaign, tracked as the Romulus ClickFix operation. Attackers bundle the legitimate, signed Siemens executable with malicious DLLs and distribute the package via fake CAPTCHA prompts. When a user runs the delivered command, the bundle is placed on disk. The next launch of Software Center loads the attacker DLLs and delivers LegionLoader, a loader that installs remote access trojans. Siemens infrastructure was not involved; the signed binary is used precisely because it passes endpoint checks that would flag an unsigned binary.
Patch: Update to Siemens Software Center V4.0.9.8. The update installs automatically on the next application launch. Indicators of compromise are available through Huntress’ published research (referenced in the related article).
Other Siemens CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2016-8562 Siemens SIMATIC CP 1543-1 Improper Privilege Management Vulnerability | [ HIGH ] | 7.5 | 3.6% |
