Siemens Software Center DLL search order as a workstation foothold

CISA added CVE-2026-110936 to the Known Exploited Vulnerabilities catalog on 20 Oct 2026. The vulnerability is a DLL search-order hijacking condition in Siemens Software Center — the update and package management application bundled with Siemens industrial automation workstation software. Siemens ProductCERT has issued an advisory; a vendor patch is available.

Forescout Research's analysis of the Romulus campaign links this class of DLL sideloading to delivery via ClickFix-style social engineering lures — browser-prompted clipboard injection that convinces users to paste and execute malicious PowerShell. The combination of social engineering delivery and a trusted Siemens binary as the execution host makes this a compound problem.

Vulnerability mechanics: CVE-2026-110936

Siemens Software Center loads one or more DLLs from a path that includes a user-writable directory. Windows DLL search order prefers directories earlier in the search path. If an attacker can write a malicious DLL with the correct filename to the user-writable directory before the legitimate DLL is found, Windows loads the attacker-controlled code in the context of the Siemens Software Center process.

The Siemens Software Center process often runs with elevated privileges to perform system-wide software management tasks. Depending on the deployment, it may run as SYSTEM or as a service account with administrative rights — meaning a low-privilege attacker who places the DLL achieves privilege escalation when the process next starts.

Romulus / ClickFix delivery context

Forescout's Romulus campaign analysis describes a ClickFix-pattern delivery chain relevant to this CVE class:

1. User encounters a lure page — typically a fake browser update, CAPTCHA, or document viewer prompt that instructs the user to paste a command into Run or PowerShell.
2. Clipboard injection — the page uses JavaScript to overwrite clipboard content with a PowerShell command the user then pastes and executes.
3. Initial payload drop — the PowerShell script downloads and drops a file (the malicious DLL) to a directory writable by the current user.
4. Trigger via Siemens Software Center — the DLL is named to match the legitimate DLL expected by Siemens Software Center; the next process start or update check sideloads it.

The ClickFix delivery mechanism requires no exploit against the browser or OS; it relies entirely on the user following instructions. This is why it is effective in OT/ICS environments where security awareness training may be less frequent than in IT.

Attack delivery to sideload chain

Operator checklist — workstation engagement

If you have low-privilege access to a Windows workstation and Siemens Software Center is installed:

# Check if Siemens Software Center is installed
Get-WmiObject -Class Win32_Product |
    Where-Object { $_.Name -like "*Siemens*" }

# Or via registry (faster)
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |
    Where-Object { $_.DisplayName -like "*Siemens Software Center*" } |
    Select-Object DisplayName, DisplayVersion, InstallLocation

# Identify the Siemens Software Center executable and process (if running)
Get-Process | Where-Object { $_.Name -like "*Siemens*" } |
    Select-Object Id, Name, Path

# Check for user-writable directories early in the DLL search path
# DLL search order: application dir, current dir, system32, windows, PATH entries
$env:PATH -split ";" | ForEach-Object {
    $dir = $_
    $acl = Get-Acl $dir -ErrorAction SilentlyContinue
    if ($acl) {
        $acl.Access | Where-Object {
            $_.IdentityReference -match "Users|Everyone|Authenticated" -and
            $_.FileSystemRights -match "Write|Modify|FullControl"
        } | ForEach-Object { "WRITABLE: $dir" }
    }
}

Evidence to capture:

• Siemens Software Center version and install path
• DLL search path and identification of user-writable directory preceding the legitimate DLL directory
• ACL output showing user-writable path
• If DLL placement and trigger are tested: process tree showing Siemens Software Center loading unexpected code

Remediation

• Apply the Siemens ProductCERT patch referenced in SSA-2026-110936.
• Until patched: restrict write access to directories in the Siemens Software Center DLL search path for non-administrative users.
• Deploy application whitelisting (AppLocker, WDAC) to restrict DLL loading to signed Siemens binaries.
• In OT/ICS environments: network-segment workstations and apply ClickFix/browser-based lure blocking via DNS filtering and URL categorisation.