Siemens Software Center CVE-2026-110936 Exploited Flaw Explained: Update to 4.0.9.8 Before Today's CISA Deadline

Image: Wikimedia Commons / Markus Spiske, CC0 (ILLUSTRATIVE — code on a monitor; the flaw is in how Siemens Software Center loads helper files, not in a device photo. No official product photo exists for this advisory.)

TL;DR: Siemens Software Center CVE-2026-110936 exploited flaw explained in one line: attackers abused a genuine, validly signed copy of Siemens Software Center by placing their own malicious DLL files next to it, so the trusted program loaded the attacker's code on start-up. Siemens fixed the flaw in version 4.0.9.8, existing installations update automatically on next start, and today, 3 November 2026, is CISA's remediation deadline for US federal agencies.

📌 KEY HIGHLIGHTS

• Flaw: CVE-2026-110936, a DLL side-loading / uncontrolled search path flaw (CWE-427) in Siemens Software Center, all versions before V4.0.9.8.
• Exploited, not theoretical: Siemens confirmed active exploitation on 19 October 2026, tied to the Romulus ClickFix campaign; CISA added it to the Known Exploited Vulnerabilities catalogue on 20 October.
• Deadline today: CISA's due date is 3 November 2026 for US federal agencies — private organisations should treat it as an urgent internal target, not a date that only applies to government.
• The twist: Siemens was not breached and its software was not modified — the attackers brought their own signed copy of the program plus poisoned DLLs, so anyone tricked into running the bundle is at risk, even if they never installed Siemens software.
• Fix: update to V4.0.9.8 or later; existing installations auto-update on next start. Also: never paste a command from a web page into Run or PowerShell.

Siemens Software Center CVE-2026-110936 exploited flaw explained: what happened

Siemens Software Center is the Windows application Siemens customers use to download, install, activate and update licensed Siemens software. On 15 October 2026 Siemens ProductCERT published advisory SSA-580366 for a flaw in that application: it loads dynamic-link libraries (DLLs) from an uncontrolled search path, so an authenticated local attacker who can place a specially crafted DLL in a directory the application searches can get code executed with the application's privileges. Siemens scores the flaw 8.4 under CVSS v4.0 (6.7 under CVSS v3.1) and credits Jose Oregon of Huntress Labs with reporting it.

Two days later, on 17 October, Siemens added the fix — version 4.0.9.8 — to the advisory. Then, on 19 October, Siemens published a separate post confirming what changes the story from a routine patch to an active incident: it had validated active exploitation of CVE-2026-110936. The attackers, Siemens says, used a genuine copy of Siemens Software Center with a valid signature and placed their own files next to it, choosing the program as a carrier precisely because it is signed and trusted, and because version 3.5.8.7 — the latest version at the time — loaded helper files from its own folder without checking them. The Siemens program itself was not modified; the malicious code is in the DLL files the attackers supplied, which the vulnerable version loaded when it started.

CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalogue on 20 October 2026, with a remediation due date of 3 November 2026. KEV is not a list of scary-sounding bugs: it is CISA's list of flaws with confirmed evidence of exploitation in the wild, and the due date binds US federal civilian agencies under CISA's BOD 26-04 directive. For everyone else, the date is still the right urgency signal — exploitation is confirmed, the fix exists, and the only question is whether vulnerable copies are still running.

How the attack works: a signed app, poisoned neighbours

This attack is a good example of why "is the file signed?" is not the same as "is this safe?". In the Romulus ClickFix campaign, the bundle distributed outside official channels contained a genuine, correctly signed Siemens Software Center executable alongside attacker-supplied DLLs in the same folder. When the victim ran the bundle, the trusted program did what vulnerable versions do — it loaded helper DLLs from its own folder without verifying they were Siemens files — and the attacker's code ran with the application's privileges, carrying the trust of a Siemens signature.

ClickFix is the delivery trick, and it is worth naming plainly because it is how victims are recruited. A web page — often dressed up as a verification or "I am not a robot" check — instructs the visitor to paste a command into the Windows Run dialog or a terminal. A real verification check never asks you to do that. Siemens' own advice puts it in one line: never paste a command from a web page into Win+R, the Run box or PowerShell. Once that command runs, the bundle lands on the PC, and the signed carrier does the rest.

Siemens is explicit about what did not happen, and the distinction matters. It says: "No Siemens system, product or update channel was breached to our knowledge," and that the malicious bundle was not distributed through official channels. Siemens systems were not the source of the malware; a trusted Siemens program was borrowed as the vehicle. That is also why the exposure is wider than Siemens' customer list: the attackers bring their own copy of the program, so any Windows PC whose user can be talked into pasting the command is in scope, whether or not that PC ever had Siemens software installed.

Detail	What is confirmed
Flaw	CVE-2026-110936 — DLL side-loading / uncontrolled search path (CWE-427) in Siemens Software Center
Affected versions	All versions before V4.0.9.8 (version 3.5.8.7 was the version abused in the campaign)
Fixed version	V4.0.9.8 or later; existing installations auto-update on next start
Severity	CVSS v4.0 8.4 (High) / CVSS v3.1 6.7, per Siemens as CNA
Exploitation	Confirmed by Siemens, 19 October 2026 — Romulus ClickFix campaign; CISA KEV added 20 October 2026
CISA deadline	3 November 2026 (US federal agencies under BOD 26-04; urgent target for everyone else)
Siemens breached?	No — Siemens says no system, product or update channel was breached to its knowledge; the program was not modified
Campaign indicators	Bundle file AllMyBasic.msi; look for Siemens Software Center in start-up on PCs that never had it installed (defanged indicators in Sources section notes)

Image: Wikimedia Commons / NERSC, CC0 (ILLUSTRATIVE — server racks; the flaw concerns a Windows desktop application, not server hardware.)

Why it matters for World Tech readers

Most exploited-flaw stories are about software you already run. This one is also about software an attacker can bring with them. That flips the usual advice: checking whether you have Siemens Software Center installed is not enough, because a victim who never used a Siemens product can still receive the bundle through a ClickFix lure. The defence that actually covers both cases is behavioural — refuse the paste-command trick — plus the technical check Siemens publishes for defenders: look for SiemensSoftwareCenter.exe running from AppData\Local\Programs and started by msiexec, unexpected DLL files next to the executable outside the default installation folder, a folder called "SM Software Provisioning Service" inside AppData\Local\Programs, files named activate.bak or statinfosta.DB next to the executable, or a folder called FTSuite containing ftc.uml inside AppData\Local.

There is a second, quieter lesson. Siemens published the advisory on 15 October, shipped the fix on 17 October, and confirmed exploitation on 19 October — a four-day arc from disclosure to confirmed abuse, with CISA's deadline landing just over two weeks later. Patch windows measured in weeks no longer fit flaws that are already being exploited when the advisory lands. If you run Siemens Software Center, starting the application installs the update automatically, so the fix here costs almost nothing — open it, let it update to 4.0.9.8 or later, and confirm the version. If you find signs of compromise, Siemens' guidance is to isolate the PC, stop the process first, then remove the start-up entry and task, and reset passwords — and to block the published indicators on firewalls, proxies and DNS resolvers.

This is a different Siemens story from our earlier Siemens Node2Shell Industrial Edge advisory explainer — that post covered a shared Brotli decoder flaw in Siemens' industrial edge products, with a 10 November KEV deadline. This post covers a separate flaw, in a separate product, with a separate fix and a deadline of today. Do not confuse the two: Node2Shell needs its own mitigations, Software Center needs version 4.0.9.8. For the pattern of exploited flaws with hard CISA deadlines, see also our WS_FTP Server critical flaw explainer — that batch, by contrast, had no confirmed exploitation when published, which is exactly why acting on this exploited one first is the right order.

Should you care?

✅ Verdict: Yes — today, not this week. If you run Siemens Software Center, open it and let it update to 4.0.9.8 or later, and check the version. If you do not run it, the action is still real: treat any web page that asks you to paste a command into Run or PowerShell as an attack, full stop. Exploitation is confirmed, the fix is automatic, and the CISA deadline is today — there is no cheaper incident to prevent than this one.

FAQs

What is CVE-2026-110936? It is a DLL side-loading flaw in Siemens Software Center, tracked as CVE-2026-110936 and classed as an uncontrolled search path element (CWE-427). Affected versions load helper DLL files from the application's own folder without checking they are Siemens files, so an attacker who places a crafted DLL there gets code executed with the application's privileges. All versions before V4.0.9.8 are affected.

Was Siemens hacked, and was Siemens Software Center itself modified? No, on both counts as Siemens states it: no Siemens system, product or update channel was breached to its knowledge, and the Siemens program in the attack bundle was not modified. The malicious code was in DLL files supplied by the attackers, placed next to a genuine, validly signed copy of the program, which the vulnerable version then loaded on start-up.

How do I update Siemens Software Center to 4.0.9.8? Start the application — Siemens says existing installations update automatically on next start — and confirm the version is 4.0.9.8 or later. The latest version can also be downloaded from Siemens' official Software Center page linked in the Sources. Only download Siemens software from official Siemens sources; the attack bundle was distributed outside official channels.

What is the CISA deadline on 3 November 2026, and does it apply to me? CISA added CVE-2026-110936 to its Known Exploited Vulnerabilities catalogue on 20 October 2026, with a 3 November 2026 remediation due date. That date legally binds US federal civilian agencies under CISA's BOD 26-04 directive; it does not automatically bind private organisations. Treat it as an urgent internal target anyway, because the catalogue entry means exploitation is confirmed, not merely possible.

Am I at risk if I never installed Siemens software? Yes, in the ClickFix scenario, because the attackers supply their own copy of Siemens Software Center in the bundle — you do not need to be a Siemens customer to be tricked into running it. The protection is to never paste commands from web pages into Run or PowerShell, and, for defenders, to hunt for the indicators Siemens published rather than trusting the Siemens file's signature.

Takeaway: A signed program is only as trustworthy as the files sitting next to it — update Siemens Software Center to 4.0.9.8 today, and never paste a command a web page tells you to run.

Follow World Tech on TechByCountry for tomorrow's update.

📸 Get tech in the last 24 hours on Instagram — follow @_techinlast24hrs for daily posts (9 AM–9 PM) and reels at 12:30 PM & 8:30 PM.

Sources

• Siemens ProductCERT — Active Exploitation of CVE-2026-110936 in Siemens Software Center (19 Oct 2026)
• Siemens ProductCERT — SSA-580366: DLL Sideloading Vulnerability in Siemens Software Center
• CISA — Known Exploited Vulnerabilities Catalog, CVE-2026-110936 (added 20 Oct 2026, due 3 Nov 2026)
• InfoSec Signals — CVE-2026-110936 record (CVSS, CWE-427, KEV status)
• Yaali Labs — Siemens Software Center flaw used to side-load ClickFix malware (23 Oct 2026)

Note on indicators: Siemens' published indicators (IP 96.62.218[.]59, domain wizardexpensive[.]com, distribution IP 2.27.248[.]127, file AllMyBasic.msi) are defanged above and in Siemens' post to prevent accidental clicks; defenders should block and search logs for them in their original form.