Key points
- Siemens Software Center versions before 4.0.9.8 contain a high-severity DLL sideloading vulnerability.
- Attackers are actively exploiting CVE-2026-110936 in the wild using ClickFix delivery methods.
- A fix is available in version 4.0.9.8; users of older versions must update immediately.
Siemens Software Center versions prior to 4.0.9.8 contain a high-severity vulnerability identified as CVE-2026-110936, which allows arbitrary code execution. The Canadian Centre for Cyber Security confirmed on October 19, 2026, that this flaw is being actively exploited in the wild, urging administrators to apply updates.
In plain English
This flaw involves DLL sideloading, where an application loads helper files from an uncontrolled directory. An attacker can place a malicious dynamic-link library in a folder the program searches, causing the system to execute harmful code with the same privileges as the legitimate software.
The background
Siemens stated the issue was patched in version 4.0.9.8, with Huntress Labs researcher Jose Oregon credited for discovery. Attackers have abused signed copies of the software by placing a crafted DLL named "archive.dll" alongside version 3.5.8.7, which loaded helper files from its own folder without verification.
What changes now
Threat actors are using the Romulus ClickFix delivery platform to deploy this malware. According to The Hacker News, campaigns often involve malicious ChatGPT Custom GPTs directing victims to fake URLs. These links serve lures that execute PowerShell code to drop an MSI installer, ultimately deploying a remote access trojan via the sideloading flaw.
Who needs to act first
Teams should prioritize updating systems exposed to external networks or user input, as these face the highest risk from ClickFix attacks. Verify current software versions against the fixed release before rolling out updates. Test the patch in a controlled environment to ensure compatibility with existing workflows. Back up critical configurations before applying changes. If immediate updates are impossible, restrict write access to directories where the software runs to prevent attackers from placing malicious files.
What to do and how to stay safe
- Update Siemens Software Center to version 4.0.9.8 or later to patch CVE-2026-110936.
- Monitor networks for traffic to known command-and-control domains such as wizardexpensive.com.
- Restrict user permissions to prevent unauthorized file placement in application directories.
- Educate staff to avoid executing suspicious scripts or clicking links in chat interfaces.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for this vulnerability?
CVE-2026-110936 has a CVSS v4 score of 8.4, which is rated as high severity.
Which version of Siemens Software Center fixes the issue?
Siemens addressed the vulnerability in version 4.0.9.8.
