Siemens confirmed active exploitation on 19 October 2026, and CISA added the flaw to its Known Exploited Vulnerabilities catalog on 20 October. Siemens ties the attacks to the Romulus ClickFix campaign.
What it allows
Siemens says the attackers used a genuine copy of Siemens Software Center with a valid signature and placed their own files next to it. The version at the time, 3.5.8.7, loaded helper files from its own folder without checking them. The Siemens program itself was not changed. The malicious code sits in the DLL files the attackers supplied.
The advisory and NVD describe the bug as local. An authenticated local attacker places a crafted DLL in a directory the application searches and gets code execution with the application's privileges. Siemens says no Siemens system, product or update channel was breached to its knowledge, and that the signed program was distributed with the malicious files outside official channels.
Siemens names the activity the Romulus multi-platform ClickFix campaign.
Forescout's ROMULUS analysis describes a ClickFix delivery platform with the same name. The address 2.27.248.127, which Siemens lists as the inactive distribution channel, is also one of the six ROMULUS addresses Forescout lists. ClickFix works because the user pastes the command; see Malicious Copy and Paste (T1204.004) and our ClickFix this week analysis.
Who is affected
All versions of Siemens Software Center before V4.0.9.8 (SSA-580366; the NVD configuration ends before 4.0.9.8). Siemens describes the product as the tool to download, install and activate purchased Siemens software.
Existing installations update to V4.0.9.8 automatically the next time the application starts. The fixed version can also be downloaded from the Siemens Software Center page. Siemens says to download its software only from official Siemens sources.
Timeline
- 15 Oct 2026
Siemens publishes advisory SSA-580366. NVD publishes the CVE record the same day.
- 15 Oct 2026
Forescout publishes its analysis of ROMULUS, a ClickFix delivery platform. Siemens later uses the name Romulus for the campaign behind CVE-2026-110936.
- 17 Oct 2026
Siemens adds the remediation to the advisory (version V1.1).
- 19 Oct 2026
Siemens confirms active exploitation in a ProductCERT post and adds a reference to it in the advisory (V1.2).
- 20 Oct 2026
CISA adds CVE-2026-110936 to the Known Exploited Vulnerabilities catalog with a due date of 3 November 2026.
What to do
-
Update to 4.0.9.8 or later
Start Siemens Software Center so it updates itself, then check the version. Siemens says to use only official Siemens sources, because the attackers distributed the signed program together with their own files.
-
Block the published indicators
Siemens asks defenders to block 96.62.218[.]59, wizardexpensive[.]com and 2.27.248[.]127 on firewalls, proxies and DNS, and to search logs for connections to them. The last address is inactive, but PCs that downloaded from it earlier may still be infected.
-
Look for the signs on a PC
Siemens lists four signs on a PC. Siemens Software Center appears in start-up apps or Task Scheduler on a PC that never had it. A folder SM Software Provisioning Service sits in AppData\Local\Programs. The files activate.bak or statinfosta.DB sit next to SiemensSoftwareCenter.exe. A folder FTSuite with ftc.uml sits in AppData\Local.
-
Hunt by behaviour, not by file hash
The Siemens executable is genuine, so its fingerprint proves nothing. Siemens advises looking for SiemensSoftwareCenter.exe running from AppData\Local\Programs and started by msiexec, and for unexpected DLLs next to Software Center executables outside the default folder.
-
If you find it, contain first
Siemens says to isolate the PC, stop the process first, then remove the start-up entry and the scheduled task, and reset passwords.
-
Cut off the way in
Siemens tells everyone never to paste a command from a web page into Win+R, the Run box or PowerShell. A real I am not a robot check never asks for this.
What Brandefense can do
- Check CVE-2026-110936 in Brandefense Atlas, free
See the current status of CVE-2026-110936 in Brandefense Atlas, with the sources behind it.
- Vulnerability Intelligence
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
What is CVE-2026-110936?
It is a DLL side-loading flaw (CWE-427) in Siemens Software Center versions before V4.0.9.8. The application loads DLLs from an uncontrolled search path, which can give code execution with the application's privileges.
Is CVE-2026-110936 exploited?
Yes. Siemens validated active exploitation on 19 October 2026, and CISA added the flaw to its Known Exploited Vulnerabilities catalog on 20 October with a due date of 3 November 2026.
Does the attack need a remote exploit?
The advisory describes an authenticated local attacker. Siemens says the attackers placed their own files next to a genuine signed copy, and it names a ClickFix campaign, where the user runs the first command.
Which version fixes it?
Siemens Software Center V4.0.9.8 or later. Existing installations update automatically at the next start.
Was Siemens breached?
Siemens says that to its knowledge no Siemens system, product or update channel was breached, and that the signed program was not modified.
Who reported the flaw?
Siemens credits Jose Oregon from Huntress Labs for reporting the vulnerability in SSA-580366.
Sources
- SSA-580366: DLL Sideloading Vulnerability in Siemens Software CenterSiemens ProductCERT
- Active Exploitation of CVE-2026-110936 in Siemens Software CenterSiemens ProductCERT
- CVE-2026-110936NIST NVD
- Known Exploited Vulnerabilities CatalogCISA
- ROMULUS: Analysis of a New Multi-Payload ClickFix Delivery PlatformForescout Research, Vedere Labs
