Quick links
Press Enter to search, Esc to close
Exploited vulnerability
A DLL side-loading flaw in Siemens Software Center, fixed in version 4.0.9.8.
In short
CVE-2026-110936 is a DLL side-loading flaw in Siemens Software Center, fixed in version 4.0.9.8. Siemens confirmed active exploitation on 19 October 2026, and CISA added the flaw to its Known Exploited Vulnerabilities catalog on 20 October. Siemens ties the attacks to the Romulus ClickFix campaign.
Siemens says the attackers used a genuine copy of Siemens Software Center with a valid signature and placed their own files next to it. The version at the time, 3.5.8.7, loaded helper files from its own folder without checking them. The Siemens program itself was not changed. The malicious code sits in the DLL files the attackers supplied.
The advisory and NVD describe the bug as local. An authenticated local attacker places a crafted DLL in a directory the application searches and gets code execution with the application's privileges. Siemens says no Siemens system, product or update channel was breached to its knowledge, and that the signed program was distributed with the malicious files outside official channels.
Siemens names the activity the Romulus multi-platform ClickFix campaign.
Forescout's ROMULUS analysis describes a ClickFix delivery platform with the same name. The address 2.27.248.127, which Siemens lists as the inactive distribution channel, is also one of the six ROMULUS addresses Forescout lists. ClickFix works because the user pastes the command; see Malicious Copy and Paste (T1204.004) and our ClickFix this week analysis.
All versions of Siemens Software Center before V4.0.9.8 (SSA-580366; the NVD configuration ends before 4.0.9.8). Siemens describes the product as the tool to download, install and activate purchased Siemens software.
Existing installations update to V4.0.9.8 automatically the next time the application starts. The fixed version can also be downloaded from the Siemens Software Center page. Siemens says to download its software only from official Siemens sources.
Siemens publishes advisory SSA-580366. NVD publishes the CVE record the same day.
Forescout publishes its analysis of ROMULUS, a ClickFix delivery platform. Siemens later uses the name Romulus for the campaign behind CVE-2026-110936.
Siemens adds the remediation to the advisory (version V1.1).
Siemens confirms active exploitation in a ProductCERT post and adds a reference to it in the advisory (V1.2).
CISA adds CVE-2026-110936 to the Known Exploited Vulnerabilities catalog with a due date of 3 November 2026.
Start Siemens Software Center so it updates itself, then check the version. Siemens says to use only official Siemens sources, because the attackers distributed the signed program together with their own files.
Siemens asks defenders to block 96.62.218[.]59, wizardexpensive[.]com and 2.27.248[.]127 on firewalls, proxies and DNS, and to search logs for connections to them. The last address is inactive, but PCs that downloaded from it earlier may still be infected.
Siemens lists four signs on a PC. Siemens Software Center appears in start-up apps or Task Scheduler on a PC that never had it. A folder SM Software Provisioning Service sits in AppData\Local\Programs. The files activate.bak or statinfosta.DB sit next to SiemensSoftwareCenter.exe. A folder FTSuite with ftc.uml sits in AppData\Local.
The Siemens executable is genuine, so its fingerprint proves nothing. Siemens advises looking for SiemensSoftwareCenter.exe running from AppData\Local\Programs and started by msiexec, and for unexpected DLLs next to Software Center executables outside the default folder.
Siemens says to isolate the PC, stop the process first, then remove the start-up entry and the scheduled task, and reset passwords.
Siemens tells everyone never to paste a command from a web page into Win+R, the Run box or PowerShell. A real I am not a robot check never asks for this.
It is a DLL side-loading flaw (CWE-427) in Siemens Software Center versions before V4.0.9.8. The application loads DLLs from an uncontrolled search path, which can give code execution with the application's privileges.
Yes. Siemens validated active exploitation on 19 October 2026, and CISA added the flaw to its Known Exploited Vulnerabilities catalog on 20 October with a due date of 3 November 2026.
The advisory describes an authenticated local attacker. Siemens says the attackers placed their own files next to a genuine signed copy, and it names a ClickFix campaign, where the user runs the first command.
Siemens Software Center V4.0.9.8 or later. Existing installations update automatically at the next start.
Siemens says that to its knowledge no Siemens system, product or update channel was breached, and that the signed program was not modified.
Siemens credits Jose Oregon from Huntress Labs for reporting the vulnerability in SSA-580366.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.
