Vulnerabilities · 4h ago

Siemens Software Center flaw hides behind signed launcher

Siemens confirmed active exploitation of CVE-2026-110936 in Software Center through the Romulus ClickFix operation. Attackers paired a genuine, digitally signed Siemens executable with malicious DLL files they supplied; Siemens says its systems and software distribution channels were not breached.

A fake CAPTCHA prompt tricks a victim into running the Siemens program. Because the app searches its own folder for helper DLLs, it loads the attackers’ files too, letting their code run with the app’s privileges. The valid signature covers the launcher, not the safety of those companion files.

Siemens says version 4.0.9.8 fixes the flaw, but installed users receive the update only when they next launch Software Center. On managed Windows systems where the app sits unused, an available fix does not mean the endpoint has received it.

CVE-2026-110936

NVD KEV

CVSS 6.7 MEDIUM: a vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). EPSS 0.1% (3rd percentile).

Timeline

Oct 19 Reported by SecurityWeek

Sources

1 source covering this story

SecurityWeek Oct 19
Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks
Attackers paired a genuine, signed copy of Siemens Software Center with malicious DLLs to infect Windows PCs via ClickFix lures.

Entities

CVE-2026-110936

Part of the PlainSec briefing for 2026-10-19

Editions

Briefing for 2026-10-19

Vulnerabilities · 4h agoSiemens Software Center flaw hides behind signed launcherSiemens confirmed active exploitation of CVE-2026-110936 in Software Center through the Romulus ClickFix operation. Attackers paired a genuine, digitally signed Siemens executable with malicious DLL files they supplied; Siemens says its systems and software distribution channels were not breached.A fake CAPTCHA prompt tricks a victim into running the Siemens program. Because the app searches its own folder for helper DLLs, it loads the attackers’ files too, letting their code run with the app’s privileges. The valid signature covers the launcher, not the safety of those companion files.Siemens says version 4.0.9.8 fixes the flaw, but installed users receive the update only when they next launch Software Center. On managed Windows systems where the app sits unused, an available fix does not mean the endpoint has received it.