Summary
- Siemens confirms active exploitation of CVE-2026-110936, corrected in Software Center 4.0.9.8.
- Attackers use a legitimate signed executable to load malicious DLLs distributed outside Siemens's official channels.
- Siemens says it has no evidence that its own systems or software update infrastructure were compromised.
Siemens has confirmed active exploitation of a vulnerability in its Software Center application, after attackers used a legitimately signed executable to load malicious code without modifying the Siemens programme itself.
The company disclosed the exploitation on 19 October, four days after publishing advisory SSA-580366 and releasing a correction for CVE-2026-110936. Siemens Software Center version 4.0.9.8 addresses the weakness, while existing installations are designed to update automatically when the application next starts.
Siemens says the campaign does not represent a compromise of its own distribution infrastructure. Its investigation has found no evidence that Siemens systems, products, or official update channels were breached.
The distinction is important because the attack relies on the trust afforded to a genuine executable rather than on a malicious update supplied by the manufacturer.
A signed application used to load malicious files
The vulnerability involves DLL side-loading, a technique in which an application loads a dynamic-link library from a location that an attacker can influence. A legitimate executable may perform the loading operation, while the attacker supplies a malicious library with the name or characteristics expected by the programme.
In this case, the attackers distributed a genuine copy of Siemens Software Center version 3.5.8.7, which carried a valid digital signature. They placed malicious files beside the executable, exploiting its handling of helper libraries when launched.
Siemens says the attackers did not alter the signed programme. The malicious functionality resided in additional DLL files included with the externally distributed package.
The company has linked the activity to the Romulus multi-platform ClickFix campaign. ClickFix techniques generally involve persuading users to execute commands or installation steps under misleading pretences, although individual campaigns vary in their delivery methods.
Siemens identified a malicious installation package, suspicious file locations, and command-and-control infrastructure associated with the campaign. It has shared information with endpoint detection and response suppliers and relevant authorities to support wider detection.
Rather than treating every installation of Software Center as compromised, the investigation identifies particular indicators, including unexpected application locations, unusual startup persistence, and additional files appearing beside the legitimate executable.
Trust in software extends beyond signatures
A valid digital signature can demonstrate that an executable was signed by a particular publisher and has not subsequently been altered. It does not establish that every component loaded by the executable is trustworthy, or that the application was acquired through an authorised distribution channel.
That limitation is especially relevant when attackers combine legitimate software with malicious supporting files. Security products and users may recognise the signed application while overlooking the separate library responsible for the harmful behaviour.
DLL side-loading also complicates incident response because an investigator who checks only the executable’s signature or cryptographic hash may find nothing wrong with the programme itself. The surrounding files, launch location, process history, and network behaviour are necessary to establish whether the signed software was being misused.
Siemens has consequently advised organisations to examine suspicious installations and accompanying DLL files rather than rely solely on detection of the Siemens executable.
The advisory also illustrates why software supply chain terminology needs precision. A compromised manufacturer’s update service could expose customers receiving otherwise legitimate updates. Here, the identified attack instead involved malicious bundles distributed outside Siemens’s authorised channels.
Both scenarios can exploit trust in recognised software, but they involve different control failures and demand different investigative conclusions.
Patch and incident response requirements
Siemens recommends updating Software Center to version 4.0.9.8 or later, obtaining software only from official sources, and investigating systems showing the published indicators of compromise.
Where compromise is suspected, the company advises isolation and investigation of the affected computer, removal of attacker persistence, and credential resets as appropriate.
Applying the corrected software version prevents further use of the identified loading weakness, but it does not by itself establish that an already compromised machine has been cleared of malicious files or additional persistence.
The company’s disclosure therefore separates vulnerability remediation from compromise assessment. An organisation can have installed the latest release and still need to investigate whether an earlier malicious bundle was executed.
Siemens has provided indicators for the known campaign and says it is coordinating with security suppliers and authorities. Its public account confirms active exploitation while explicitly rejecting the suggestion that attackers breached its official update channel.
