Attackers Exploit Siemens Software Center DLL Side‑Loading Flaw (CVE‑2026‑110936)
What It Is – Siemens disclosed a DLL side‑loading vulnerability (CVE‑2026‑110936) in its Software Center tool that allows malicious DLLs placed alongside the signed installer to be loaded and executed.
Exploitability – Active exploitation is confirmed in the ClickFix “Romulus” campaign; a CVSS v4.0 score of 8.4 rates it as high severity.
Affected Products – Siemens Software Center 3.5.8.7 (and earlier) on Windows; patched in version 4.0.9.8.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous verification of software supply‑chain integrity – a single trusted binary can become a delivery vehicle for malware.
- Highlights gaps in control monitoring around signed‑code validation and folder‑level isolation, which auditors now expect evidence of.
- Enterprise buyers increasingly demand demonstrable assurance that all third‑party tools are vetted, patched, and their execution paths are continuously logged.
Recommended Actions
- Inventory all instances of Siemens Software Center and verify they run version 4.0.9.8 or later.
- Enforce strict application control policies (e.g., Windows AppLocker or similar) that block unsigned or unexpected DLLs in the installer directory.
- Integrate the software‑install event logs into a continuous monitoring platform to provide audit‑ready evidence of compliance with supply‑chain integrity controls.
Source: Help Net Security article