CVE-2026-110936 is a DLL side-loading vulnerability (CWE-427, uncontrolled search path element) in Siemens Software Center. The application loads helper files from its own folder without checking them, so a malicious DLL placed next to the executable runs with the application's privileges.

The following product is affected:

• Siemens Software Center, version 3.5.8.7 (the latest release at the time of the attacks) and, according to one analysis, all versions earlier than 4.0.9.8

Not affected / patched version:

• Siemens Software Center 4.0.9.8 or later
• Existing installations should update automatically at the next start. Administrators should verify the installed version rather than assume the update occurred

Successful exploitation may allow attackers to:

• Run attacker-supplied code with the privileges of the logged-in user, hidden inside a genuine, validly signed Siemens program
• Install follow-on malware and establish command-and-control connections from the endpoint
• Evade detection that relies on file hashes or signatures of the Siemens executable

CERTVU recommends the following:

1. Update Siemens Software Center

   Update to version 4.0.9.8 or later on all endpoints and confirm the installed version. Download Siemens software only from official Siemens sources.

2. Block and search for the indicators

3. Detect by behavior, not by the Siemens file

   Report suspected compromise to CERTVU.