Siemens ProductCERT said on October 19 that it has validated active exploitation of CVE-2026-110936, a DLL side-loading flaw in Siemens Software Center, and that a fixed version, 4.0.9.8, is available.
What Siemens reported
The company’s ProductCERT post says the weakness was fixed in version 4.0.9.8 and covered by advisory SSA-580366, which Siemens published on October 15. Existing installations update automatically the next time the application starts. Siemens states that “No Siemens system, product or update channel was breached to our knowledge,” and that EDR vendors and authorities have been engaged to share intelligence.
The post attributes the activity to what it calls the Romulus multi-platform ClickFix campaign. ClickFix lures persuade a person to run attacker-supplied commands on their own machine and the entry point in these cases is the user’s own keyboard. Siemens does not say how many customers are affected, which sectors they belong to or what the final payload does. The post lists a malicious MSI package named AllMyBasic.msi and a DLL named archive.dll, with SHA-256 hashes for both.
How the signed program became the carrier
According to Siemens, the attackers took a genuine copy of Software Center with a valid signature and placed their own files next to it. They chose the program as a carrier, the post says, “because it is signed and trusted, and because version 3.5.8.7, the latest version at the time, loaded helper files from its own folder without checking them.” The Siemens program itself was not modified. The malicious code sits in the DLL files the attackers supplied, which the vulnerable version loaded when it started.
That detail changes what a defender can rely on. Siemens tells customers to “Detect on folder and behaviour, not on the Siemens file fingerprint: the file itself is genuine.” A hash or signature check on SiemensSoftwareCenter.exe passes, because the executable is the real one. The evidence is in what sits beside it and in what launched it.
Two scores for one flaw
The advisory SSA-580366 describes an application that “loads dynamic-link libraries (DLLs) from an uncontrolled search path,” which “could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application”. It lists a CVSS v3.1 base score of 6.7 and a CVSS v4.0 base score of 8.4. The v3.1 vector printed in the advisory records high privileges required.
A team that sorts its queue by a single base score could rank this flaw as medium or as high depending on which version its scanner reports. The advisory text lists a local, authenticated attacker, while Siemens’ own blog describes exploitation that begins with a user running pasted commands. A patch ticket for this CVE therefore needs to say that exploitation has been confirmed by the vendor, whatever number the scanner prints.
Indicators and warning signs Siemens published
Siemens lists three pieces of infrastructure: the IP address 96.62.218[.]59 and the domain wizardexpensive[.]com, both marked active when the post went up, and the IP address 2.27.248[.]127, marked inactive and described as the distribution channel for the malware bundle. The post tells defenders to block the active entries and to search logs for connections to all three, including the inactive one, because systems that downloaded from it before it went offline may still be infected.
On an individual PC, the post names these warning signs:
- “Siemens Software Center” in the start-up apps or Task Scheduler of a PC that never had it installed.
- A folder called SM Software Provisioning Service inside AppData\Local\Programs.
- Files named activate.bak or statinfosta.DB next to SiemensSoftwareCenter.exe.
- A folder called FTSuite containing a file ftc.uml inside AppData\Local.
- SiemensSoftwareCenter.exe running from AppData\Local\Programs and started by msiexec.
If a machine matches, Siemens says to isolate the PC, stop the process first, remove the start-up entry and the scheduled task, and reset passwords.
What it means for the security leader
Other vendors have published exploitation notes this month alongside their fixes. Palo Alto Networks did so in its PAN-OS notice for CVE-2026-0322, and Microsoft reported exploitation of a Windows Shell flaw in its notice for CVE-2026-96951. In the Siemens case the advisory was dated October 15 and the exploitation post followed four days later.
In our reading, the practical gap for most organizations sits in software that updates itself. Siemens says existing installations of Software Center update on next start, which covers machines where the application is opened. A machine where it was installed years ago and never started again stays on the old version until someone runs it. An inventory that lists where Software Center is installed and which version each copy reports answers that question in minutes. Without one, the team is left searching for the carrier on a machine that never had it.
The ClickFix step also deserves its own control. Siemens puts the user instruction plainly: “Never paste a command from a web page into Win+R, the Run box or PowerShell.” Organizations that can restrict the Run dialog or log PowerShell script blocks have a place to detect the first step before any DLL is involved.
What to do this week
- Confirm every Software Center installation reports 4.0.9.8 or later, and treat any copy outside the default install folder as suspect.
- Block 96.62.218[.]59, wizardexpensive[.]com and 2.27.248[.]127 at the firewall, proxy and DNS resolver, then search historical logs for the same three.
- Hunt for unexpected DLLs next to Siemens Software Center executables and for the folder and file names listed above.
- Write detections on folder and process lineage, since the signed executable passes a hash check.
- Download Siemens software only from official Siemens sources, as the post advises.
Source: Siemens ProductCERT, Active Exploitation of CVE-2026-110936 in Siemens Software Center
