Siemens Confirms Software Center Flaw CVE-2026-110936 Exploited in the Wild in ClickFix Attacks
Do Son 
TL;DR
On October 19, 2026, Siemens confirmed that attackers are exploiting CVE-2026-110936 in the wild. The Siemens Software Center vulnerability is a DLL sideloading flaw that a ClickFix campaign uses to run malware under a trusted, signed program. Version 4.0.9.8 fixes it.
- CVE: CVE-2026-110936
- CVSS: 8.4 (High · CVSSv4)
- Product: Siemens Software Center
- Affected: < V4.0.9.8
- Status: Exploited in the wild
- Patched in: V4.0.9.8
- EPSS: 0.1% (30-day)
- Action: Update to V4.0.9.8 now
Why It Matters
Siemens Software Center downloads, installs and updates Siemens software. Its files carry a valid Siemens signature, which makes them a useful disguise. In its active exploitation notice, Siemens says attackers “chose this program as a carrier because it is signed and trusted.”
As a result, security tools may trust the malware’s host process. That makes this Siemens Software Center vulnerability, now exploited in the wild, harder to spot. Siemens stresses its own systems were not hacked. “No Siemens system, product or update channel was breached to our knowledge,” the company said.
How the Attack Works
Advisory SSA-580366 explains that the app “loads dynamic-link libraries (DLLs) from an uncontrolled search path.” The flaw scores 6.7 on CVSS v3.1 and 8.4 on CVSS v4.0.
In the real campaign, attackers bundled a genuine copy of the program with their own malicious DLLs. Victims were tricked by ClickFix lures into installing the bundle. When the program started, it loaded the attacker files. As Siemens notes, “the Siemens program was not modified.”
Exploitation status
Siemens confirms the flaw is exploited in the wild and links it to the Romulus ClickFix campaign. Forescout separately found the bundle’s distribution server among Romulus infrastructure, SecurityWeek reported. Huntress researcher Jose Oregon reported the bug. CISA has not yet added it to its KEV catalog.
Affected Versions
All Siemens Software Center versions before 4.0.9.8 are affected, including 3.5.8.7, which attackers abused.
Patch and Mitigation Steps
- Update to version 4.0.9.8 or later. Existing installs update the next time they start.
- Download Siemens software only from official Siemens sources.
- Block 96.62.218[.]59, wizardexpensive[.]com and 2.27.248[.]127.
- Look for SiemensSoftwareCenter.exe running from AppData\Local\Programs after an msiexec launch.
- Detect on folders and behavior, since the signed file itself is genuine.
Above all, users should never paste commands from a web page into the Run box. Full indicators for this Siemens Software Center vulnerability are in the Siemens ProductCERT blog post.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
