Siemens has confirmed that attackers are exploiting a DLL side-loading bug in Software Center, its tool for finding, installing and managing the company’s products. The flaw is tracked as CVE-2026-110936 and scored 8.4 under CVSS v4.0.
The advisory first appeared on October 15. Two days later Siemens updated it to say version 4.0.9.8 closes the gap, and on October 19 the company published a warning that exploitation was underway.
Why a signed binary helped the attacker
Software Center loads libraries from a search path it does not control. Plant a crafted DLL in a directory the application probes and it executes with the application’s privileges.
According to Siemens, the crews shipped a genuine, validly signed copy of the tool and dropped their own files beside it. The executable was never modified. Version 3.5.8.7, current at the time, collected helper files from its own folder without checking them, which is what made the package a usable carrier.
The entry point was ClickFix: fake verification pages and paste-this-command lures that talk a user into running the installer themselves. Huntress reported the bug, with the company crediting Jose Oregon.
What Siemens says was not hit
No Siemens system, product or update channel was breached to its knowledge. Customers on 3.5.8.7 should move to 4.0.9.8 now rather than wait for a maintenance window.
Detection notes
Hunt for Software Center executions whose parent process is a browser or terminal, and for unexpected DLLs sitting in the application directory. Block the ClickFix pattern at the endpoint: no user should be pasting commands from a web page into a run dialog, and blocking clipboard-driven execution removes the delivery step entirely.
