CISAAnalysisCISA adds Siemens Software Center DLL side-loading flaw to KEV catalog
What happened.CISA added an actively exploited DLL side-loading defect in Siemens Software Center to its Known Exploited Vulnerabilities catalog.
Why it matters.Industrial software suites manage critical engineering workflows, operational controllers, and plant connectivity. Weaponizing trusted vendor binaries through DLL side-loading lets threat actors bypass application allowlisting and evade endpoint detection agents. Security teams must deploy the updated installer release and scan endpoint directories for unexpected DLL files.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-110936 and Siemens advisory SSA-580366, an uncontrolled search path element allows the executable to load untrusted dynamic libraries from its working directory.
- Exploitation path: Attackers deploy malicious DLL helpers alongside signed application binaries during ClickFix social engineering campaigns to install remote access trojans without triggering security alerts.
- Remediation releases: Siemens patched the flaw in Software Center version 4.0.9.8, while CISA mandated that federal civilian agencies remediate exposed installations under Binding Operational Directive timelines.
STORYLINE PROGRESSION & CONTEXT
This report represents a verified evolution of prior newsroom intelligence: