Siemens Confirms Active Exploitation of Software Center Flaw

Siemens updated the security alert SSA-580366 on Monday (19) to inform that the CVE-2026-110936 vulnerability in the Siemens Software Center is being actively exploited. The flaw was disclosed on October 15. Until Monday, the alert did not mention real attacks; the company then added a link to a blog post describing the campaign, according to SecurityWeek and Security Online.

The Software Center is the application that customers of Siemens' industrial software division use to download, install, and activate purchased programs. The flaw is of the unregulated search path DLL loading type, classified as CWE-427: the program does not adequately restrict where it looks for libraries and loads files residing in its own folder. Versions prior to 4.0.9.8 are affected. The fix automatically reaches those who already have the application installed the next time it is opened. Stations that go weeks without running the program remain at the vulnerable version until then, making an active inventory necessary in environments with hundreds of engineering machines.

The Signed Binary as Bait

The point that changes the risk assessment lies in the mechanics of the attack. According to the description published by Siemens and reported by SecurityWeek, the criminals combined a legitimate, digitally signed copy of the Software Center with malicious DLLs they provided. When executed, the program loaded libraries from its own folder and ran the attackers' code.

This means that exposure is not limited to Siemens customers. The attacker takes the vulnerable executable along with the bait, and any Windows machine can be targeted. Endpoint protection tools that trust binaries signed by large manufacturers tend to allow the process to run. This technique, known as DLL sideloading, is old; what makes it effective here is the trust seal from one of Europe's largest industrial companies.

The delivery uses ClickFix bait, where the victim sees a false verification or error message and is induced to paste and execute a command on their own computer. Siemens claims that, as far as it knows, no system, product, or update channel of the company has been breached. The alerts do not identify the attackers, the affected organizations, or the scale of exploitation.

CVE-2026-110936: Score 6.7, Elevated Risk

CVE-2026-110936 has a score of 6.7 on the CVSS v3.1, considered medium range. It is exactly the type of flaw that gets left behind in queues of prioritized fixes based solely on the score. The score reflects the requirement for local access to plant the DLL; it does not capture the scenario in which the attacker convinces the user to execute the package. For security teams, this case reinforces the logic of prioritizing based on confirmed exploitation rather than just nominal severity.

The class of problem is also not new in the same product. Dragos had previously described, in an earlier alert, issues of DLL hijacking in the same Siemens Software Center. A vulnerability that reappears in the same application suggests that the application's library search pattern warrants architectural review, not just ad-hoc fixes.

Germany, Canada, and the Global Fix Queue

Siemens, based in Munich, is the source of the fix, but the quickest government response came from Canada. The Canadian Centre for Cyber Security published alert AV26-1063 on October 19, citing SSA-580366 and recommending that administrators apply the updates.

For industrial customers, the exposure channel is twofold. Engineers using the Software Center to manage licenses for design and simulation tools need to ensure version 4.0.9.8 is applied. And security teams in any company, whether a Siemens customer or not, must treat standalone copies of the executable in download or temporary folders as indicators of compromise.

This incident adds to a rising wave of ClickFix campaigns documented in recent weeks. On October 14, Forescout published an analysis of ROMULUS, a distribution panel delivering multiple malicious payloads through ClickFix baits, which the company found on six IP addresses. Siemens has not publicly attributed the campaign against the Software Center to this panel. However, the similarity in method indicates that operators of these campaigns are choosing signed binaries from respected manufacturers as standard kit items, and the list of legitimate programs with DLL loading flaws is long enough that Siemens may not be the last brand exploited.