Loading vulnerability…
DLL Sideloading in Siemens Software Center
CVE-2026-110936 is an uncontrolled DLL search path vulnerability in Siemens Software Center versions earlier than 4.0.9.8. The application loads libraries from insufficiently restricted search locations, allowing an authenticated local attacker to plant a specially crafted DLL that executes with the application's privileges. Observed attacks paired an unmodified, legitimately signed Software Center 3.5.8.7 executable with malicious libraries distributed outside official Siemens channels. Siemens confirmed active exploitation on October 19, 2026, and linked the activity to the Romulus ClickFix operation.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises confidentiality, integrity, and availability within the privileges available to Siemens Software Center. Malicious libraries execute inside the trusted application's process, enabling malware execution while benefiting from the executable's legitimate signature and reputation. Elevated execution can increase the extent of compromise, but the vulnerability does not inherently grant privileges beyond those of the affected application.
If you can’t patch tonight, do this now.
Restrict write access to DLL search locations and run Software Center with the least privileges necessary. Investigate unexpected installations, execution from user-writable directories, installer-driven launches, suspicious adjacent libraries, and unauthorized startup entries or scheduled tasks. Do not rely solely on the executable's signature or hash to establish trust. Block known campaign infrastructure and discourage execution of commands supplied by webpage verification or repair prompts. If compromise is detected, isolate affected endpoints, terminate malicious processes, remove unauthorized persistence, and reset potentially exposed credentials.
Patch, then assume compromise.
Upgrade Siemens Software Center to version 4.0.9.8 or later using official Siemens distribution channels. Existing installations receive the update automatically when the application next starts; verify that the update completes and the installed version is fixed. Updating an installed copy does not remediate older vulnerable executables independently distributed by attackers, so investigate and remove unauthorized copies.
No valid public exploits. Mallory filtered out 1 candidate as fakes, detection scripts, or README-only repos.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
74 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.