CVE-2026-110936
CVSS 6.7 MEDIUM: a vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). EPSS 0.1% (3rd percentile).
Vulnerabilities & Exploits
Siemens confirmed active exploitation of CVE-2026-110936 in Software Center through the Romulus ClickFix operation. Attackers paired a genuine, digitally signed Siemens executable with malicious DLL files they supplied; Siemens says its systems and software distribution channels were not breached.
A fake CAPTCHA prompt tricks a victim into running the Siemens program. Because the app searches its own folder for helper DLLs, it loads the attackers’ files too, letting their code run with the app’s privileges. The valid signature covers the launcher, not the safety of those companion files.
Siemens says version 4.0.9.8 fixes the flaw, but installed users receive the update only when they next launch Software Center. On managed Windows systems where the app sits unused, an available fix does not mean the endpoint has received it.
1 source · Oct 19
CVSS 6.7 MEDIUM: a vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). EPSS 0.1% (3rd percentile).
SecurityWeek
Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks
Attackers paired a genuine, signed copy of Siemens Software Center with malicious DLLs to infect Windows PCs via ClickFix lures.
originalPart of the PlainSec briefing for 2026-10-19
Every edition of this story: Siemens Software Center flaw hides behind signed launcher