Siemens confirms attacks on older Software Center versions; version 4.0.9.8 or newer closes the gap.
Key points
- Siemens confirms that attackers are already exploiting a DLL side-loading vulnerability in the Siemens Software Center.
- Versions before 4.0.9.8 are affected. According to the manufacturer, the program updates itself automatically to a protected version the next time it starts.
- The US agency CISA added the vulnerability to its Known Exploited Vulnerabilities Catalog on 20 October 2026 — a useful signal for IT teams everywhere, not a UK-specific deadline.
Anyone with the Siemens Software Center installed on a PC should start the program soon and then check the installed version. Siemens reports real attacks exploiting vulnerability CVE-2026-110936. The manufacturer fixed it with version 4.0.9.8; according to the security advisory, older versions remain affected.
What attackers are exploiting
The flaw lies in how the program handles so-called DLL files. Siemens describes an older version loading helper files from an insufficiently controlled search path. An attacker who already has local access to the machine could place a manipulated DLL there and, when the program starts, run their own code with its privileges. The technical classification is CWE-427; Siemens names a CVSS score of 6.7 under version 3.1 and 8.4 under version 4.0.
This is not a report of a successful break-in into Siemens’ own update infrastructure. Siemens states explicitly that it is not aware of any compromise of its own systems, products or update channels. In the attack the company describes, attackers used a genuine, signed copy of the Software Center as a carrier and placed extra files alongside it. The vulnerability requires local access; it does not mean every internet-connected machine is automatically at risk.
How to check your version
Security advisory SSA-580366 lists all versions before 4.0.9.8 as affected. Siemens recommends version 4.0.9.8 or newer. Already-installed Software Center versions should, according to the manufacturer, update automatically the next time the program starts. The version display should then be checked again; in managed company environments, the IT department may be responsible for that.
Installation files should come exclusively from official Siemens sources. Siemens also warns against online instructions urging users to paste an alleged verification text into Windows “Run” or PowerShell. Such prompts are not a legitimate CAPTCHA test. An update closes the known software gap, but it does not substitute for a check if potentially malicious files were already run beforehand.
What to do if you suspect something
Anyone who did not install the Software Center themselves, or who notices unusual startup entries or suspicious accompanying files, should not delete files or change passwords on the same machine on their own initiative. In companies, the IT security team should be informed. Siemens recommends disconnecting the device from the network if there are concrete signs of infection and having the incident investigated under the organisation’s own emergency procedure. Passwords should only be changed from a device classed as clean.
In the United Kingdom, the National Cyber Security Centre (NCSC) is the body that generally advises organisations on prioritising actively exploited vulnerabilities such as this one. the UK National Cyber Security Centre (NCSC).
Frequently asked questions
Am I affected if I don’t use any Siemens software?
The advisory concerns the Siemens Software Center specifically. Anyone who neither installs nor manages it does not need to take action on their own device because of this particular flaw. In companies, the software may still be present on administered workstations.
Which version counts as safe?
Siemens names version 4.0.9.8 or newer as the fix. All older versions are listed as affected in the security advisory.
Is the update enough if I’ve already noticed suspicious files?
An update closes the known vulnerability, but it does not establish whether a machine was already compromised. If there are concrete signs, the IT security team or a qualified incident-response service should check the device.
Is the Siemens Software Center installed on your systems, and do you check updates yourself or through central IT management? Share your experience in the comments.
Sources and status
- Siemens ProductCERT: active exploitation of CVE-2026-110936, 19 October 2026
- Siemens ProductCERT: security advisory SSA-580366
- CISA: Known Exploited Vulnerabilities Catalog (CVE-2026-110936 added 20 October 2026)
- the UK National Cyber Security Centre (NCSC)
Transparency note: AI-assisted tools were used in researching, structuring and writing this article. The sources used are listed in the article. Publication takes place only after manual editorial approval. Localised edition based on an article from Net Trends, researched for the United Kingdom. Image note based on the German original: own illustration created for Net Trends, not a screen capture.
Share this article
