Siemens Software Center DLL Sideloading Flaw Actively Exploited in Wild
Attackers are abusing a high-severity flaw in Siemens Software Center to deploy remote access trojans via ClickFix campaigns.
Key points
- CVE-2026-110936 allows arbitrary code execution through DLL sideloading in Siemens Software Center versions prior to 4.0.9.8.
- The Canadian Centre for Cyber Security confirmed active exploitation as of October 15, 2026.
- Threat actors use signed copies of the software to load malicious DLLs, often delivered via Romulus ClickFix platforms.
Siemens confirmed on October 19, 2026, that attackers are actively exploiting a high-severity vulnerability in its Software Center product. The flaw, tracked as CVE-2026-110936, allows malicious code execution through DLL sideloading. The Canadian Centre for Cyber Security issued advisory AV26-1063 to alert users of the ongoing threat.
At a glance
- Publisher
- Canadian Centre for Cyber Security
- CVEs
- CVE-2026-110936
The vulnerability carries a CVSS v4 score of 8.4, classifying it as high severity. According to Siemens, the issue stems from the application loading dynamic-link libraries from an uncontrolled search path. An authenticated local attacker can place a crafted DLL in a directory the application searches, leading to arbitrary code execution with the privileges of the affected service.
Context and Background
Huntress Labs researcher Jose Oregon discovered and reported the shortcoming. Siemens addressed the issue in version 4.0.9.8. The vendor noted that attackers are abusing genuine, signed copies of Siemens Software Center to bypass trust mechanisms. They place a malicious DLL named "archive.dll" next to the legitimate executable to trigger execution of their code.
Siemens stated that attackers chose this program as a carrier because it is signed and trusted. Version 3.5.8.7, which was the latest version at the time of the initial abuse, loaded helper files from its own folder without verifying them. This behavior allowed threat actors to execute malicious payloads with the same privileges as the legitimate application.
Who Is Affected
The exploitation is linked to a ClickFix delivery platform called Romulus, detailed by Forescout last week. Romulus is used to deliver Legion Loader and other malware using DLL sideloading techniques. According to Huntress, some campaigns leverage malicious ChatGPT Custom GPTs to direct victims to fake URLs.
These lures prompt victims to copy and execute PowerShell code that drops an MSI installer. The installer abuses the DLL sideloading flaw to ultimately deploy a remote access trojan. Siemens shared indicators of compromise, including IP addresses 96.62.218[.]59 and 2.27.248[.]127, and the domain wizardexpensive[.]com.
What should you do?
The Canadian Centre for Cyber Security encourages users and administrators to review provided web links and apply necessary updates. Siemens has released a patch in version 4.0.9.8. Organizations should verify their current software versions and ensure they are updated to mitigate the risk of arbitrary code execution.
What to do and how to stay safe: Siemens
- Audit your environment for installations of Siemens Software Center and verify the version number against the patched release 4.0.9.8.
- Monitor network traffic for connections to the known indicators of compromise, including the IP addresses and domains listed by Siemens.
- Review PowerShell execution logs for unusual activity, particularly scripts that download or execute MSI installers from untrusted sources.
- Educate users about the risks of executing code provided via ChatGPT or other AI interfaces, as these are being used as initial lures.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Siemens Software Center are vulnerable?
Versions prior to 4.0.9.8 are affected by CVE-2026-110936.
Is there a fix available for this vulnerability?
Yes, Siemens has patched the issue in version 4.0.9.8.
How are attackers delivering the malicious payload?
Attackers use ClickFix campaigns via the Romulus platform, often luring victims through malicious ChatGPT Custom GPTs to execute PowerShell code.
