CVE-2026-110936

CVE-2026-110936 is a DLL side-loading flaw in Siemens Software Center, the Windows app Siemens customers use to download, install and update their software.

It is not new. Siemens published advisory SSA-580366 on 15 October 2026. It added the fixed version on 17 October. It confirmed active exploitation on 19 October. CISA added the flaw to its KEV catalog on 20 October.

The app loads DLLs from an uncontrolled search path. The weakness is CWE-427. A crafted DLL placed in a folder it searches runs with the app's privileges.

Siemens scores it CVSS 4.0 8.4 (High). The CVSS 3.1 score is 6.7. The full vector is in the CVSS field. NVD has analyzed the record.

Affected: all versions before 4.0.9.8. Fixed: 4.0.9.8 or later. Installed copies update themselves on the next start.

How it was exploited. Siemens says attackers shipped a genuine, validly signed copy of the app, version 3.5.8.7, with their own DLLs beside it. They delivered the bundle through ClickFix lures, fake checks that trick users into pasting a command. Siemens ties the campaign to Romulus, a ClickFix delivery platform. Siemens says none of its systems or update channels were breached.

KEV. Added 20 October 2026. Federal agencies must act by 3 November 2026. Known ransomware use: unknown.

PoC status. No public PoC. One GitHub repository named after the CVE is a detection-practice notebook, not exploit code.

Credit: Jose Oregon of Huntress Labs.

Read the full story and response checklist.