Siemens Confirms Software Center DLL Sideloading Flaw Exploited to Smuggle Malware via a Trusted Signed App (CVE-2026-110936)

Scope: Siemens Software Center, all versions prior to V4.0.9.8

Severity: Amber

Siemens confirmed on October 19, 2026, that CVE-2026-110936 is being actively exploited and has linked the activity to Romulus, a multi-platform ClickFix campaign. Software Center is the tool Siemens customers use to download, install, activate, and update software they have purchased, and the flaw exists because it loads DLL files from an uncontrolled search path. Attackers are pairing a genuine, legitimately signed copy of Software Center with a malicious DLL file placed alongside it, so when the trusted program runs, it unknowingly loads and executes the attacker’s code with its own privileges, all while carrying a valid digital signature that most security tooling and users would not think to question. This technique, commonly called DLL sideloading, is attractive to attackers precisely because it hides malicious execution behind software that already has an established reputation. Organisations using Siemens Software Center must update to version V4.0.9.8 or later, and should treat any unexpected or unauthorised Software Center installation found on a device as worth investigating rather than dismissing as a legitimate Siemens tool simply because it is signed.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.