Siemens Software Center flaw exploited through signed copies

Siemens Software Center flaw exploited through signed copies

19 October 2026: Siemens has confirmed active exploitation of CVE-2026-110936, a DLL side-loading flaw in Siemens Software Center (CVSS 4.0 score 8.4, CVSS 3.1 score 6.7) that lets a malicious DLL placed beside the program run with its privileges. Version 4.0.9.8 fixes it, and existing installations update automatically the next time they start.

Not yet independently verified. CISA's catalogue confirms the flaw was added on 20 October 2026 and the 3 November due date has passed. The Romulus campaign details and indicators still come from Siemens ProductCERT alone. We will update this when it can be confirmed, and remove this note.

How the attack works

Siemens Software Center is the desktop tool Siemens customers use to download, install, activate and update licensed Siemens software. Advisory SSA-580366, first published on 15 October and updated on 17 and 19 October, says every version before 4.0.9.8 loads DLLs from an uncontrolled search path (CWE-427).

The ProductCERT post of 19 October explains why that matters. The attackers did not touch any Siemens system or update channel. They took a genuine, validly signed copy of version 3.5.8.7, the latest at the time, and shipped it next to their own DLLs, such as archive.dll, inside an installer named AllMyBasic.msi distributed outside Siemens' channels. Because the signed program loaded helper files from its own folder without checking them, it ran the attackers' code at start-up. Siemens attributes the activity to the "Romulus multi-platform ClickFix campaign", which tricks users into pasting a command into the Windows Run box or PowerShell. The flaw was reported by Jose Oregon of Huntress Labs.

Fixed version

Product	Affected	Fixed
Siemens Software Center	all versions before 4.0.9.8	4.0.9.8 or later (auto-update on next start, or download from Siemens)

Signs of compromise

Siemens lists these indicators, defanged:

• IP address 96.62.218[.]59 and domain wizardexpensive[.]com (active, payload hosting and command and control), and 2.27.248[.]127 (inactive distribution);
• "Siemens Software Center" in start-up apps or scheduled tasks on a PC that never had it;
• SiemensSoftwareCenter.exe running from AppData\Local\Programs, started by msiexec, with a folder named SM Software Provisioning Service;
• files named activate.bak or statinfosta.DB beside the executable, or an FTSuite folder holding ftc.uml under AppData\Local.

Siemens advises detecting on folder and behaviour rather than the program's file hash, because the Siemens file is genuine. On an affected PC, isolate it, stop the process, remove the start-up entry and scheduled task, and reset the user's passwords.

The Canadian Centre for Cyber Security reports that CISA added CVE-2026-110936 to its Known Exploited Vulnerabilities catalogue on 20 October, which sets a remediation deadline for US federal agencies.

Sources

• Siemens ProductCERT: SSA-580366, DLL side-loading in Siemens Software Center, 15 October 2026
• Siemens ProductCERT: Active exploitation of CVE-2026-110936 in Siemens Software Center, 19 October 2026
• Canadian Centre for Cyber Security: Siemens security advisory (AV26-1063), 19 October 2026
• Canadian Centre for Cyber Security: Siemens security advisory (AV26-1063), Update 1, 20 October 2026
• CISA: Known Exploited Vulnerabilities catalogue, CVE-2026-110936 added, 20 October 2026