SIEMENS has disclosed that threat actors exploited a vulnerability in its Software Center—tracked as CVE-2026-110936—as part of a malware campaign. The flaw arises because Software Center does not adequately restrict the folders it searches for DLL files, allowing an authenticated local attacker to place a malicious DLL in a searched directory and execute it with the same privileges as the application.
Siemens’ advisory, issued on 15 October, initially rated the issue at CVSS v4 8.4, and on 17 October updated guidance stating that version 4.0.9[.]8 resolves the problem. Users with the affected software will receive the fix the next time they launch the application.
Security researchers say attackers coupled a legitimate, digitally signed Siemens Software Center installer with attacker-provided DLLs. When launched, the program loaded those files from its own folder, enabling code execution without tampering with Siemens’ distribution channels. Siemens emphasised that no system, product or update channel was compromised, and that the malware package was delivered via the normal update mechanism on customers’ machines rather than through Siemens’ own distribution.
The company has linked the operation to Romulus, a multi-platform ClickFix campaign, and published indicators of compromise to aid detection. Defenders are advised to monitor for suspicious activity in the Software Center folders and related execution paths, rather than relying on file hashes.