// AI threat desk · 21 Oct 2026
Home/CVE · Vulns & Patches
Vulns & PatchesHighCVECVSS 8.4

Siemens confirms active exploitation of Software Center flaw

Siemens confirmed active exploitation of CVE-2026-110936 in Software Center on Oct 19 and fixed it in version 4.0.9.8.

· 2 min read
AI-generated image of security analysts reviewing a software vulnerability alert in a monitoring centre.
AI-generated image, not a photo of the event.
Key takeaways
  • Siemens confirmed active exploitation of CVE-2026-110936 in Software Center.
  • SecurityWeek said an authenticated local attacker could use a malicious DLL to execute code with Software Center’s privileges.
  • Siemens fixed the weakness in Software Center version 4.0.9.8.

Siemens confirmed on Oct 19 that attackers were actively exploiting CVE-2026-110936, a DLL side-loading vulnerability in Siemens Software Center.

SecurityWeek reported that an authenticated local attacker could place a malicious DLL in a folder Software Center searched and execute code with the application’s privileges. The vulnerability has a CVSS v4 score of 8.4.

The attacks used a genuine, validly signed copy of Software Center and placed malicious DLL files beside it. Siemens linked the activity to the Romulus multi-platform ClickFix campaign and said no Siemens system, product or update channel was breached to its knowledge.

On this page

Flaw lets Software Center load malicious DLLs from searched folders

SecurityWeek said the flaw exists because Software Center does not properly restrict the locations it searches for DLL files. An authenticated local attacker could plant a malicious DLL in one of those folders and have code executed with the same privileges as Software Center.

Siemens said the attackers used a genuine copy with a valid signature and placed their own files next to it. The company said, “No Siemens system, product or update channel was breached to our knowledge.”

Siemens linked the activity to the Romulus ClickFix campaign

Siemens linked the attacks to the Romulus multi-platform ClickFix campaign. ClickFix is a social engineering technique that typically shows a webpage popup instructing a viewer to run a system command that installs malware.

Forescout said it found a server hosting a panel called ROMULUS that turned out to be a new multi-payload ClickFix delivery platform.

Siemens published advisory SSA-580366 on Oct 15 and fixed the weakness in Software Center version 4.0.9.8. Existing installations update automatically the next time they start.

What to do now

  1. Update to V4.0.9.8 or later version.
  2. Block 96.62.218[.]59, wizardexpensive[.]com and 2.27.248[.]127.
  3. If found: isolate the PC, stop the process first, then remove the start-up entry and task, and reset passwords.

FAQ

What happened to Siemens Software Center?

Siemens confirmed that CVE-2026-110936 was actively exploited. The flaw is a DLL side-loading vulnerability in Software Center.

Who is affected by CVE-2026-110936?

The affected product is Siemens Software Center. Siemens fixed the weakness in version 4.0.9.8.

How could CVE-2026-110936 be exploited?

SecurityWeek said an authenticated local attacker could place a malicious DLL in a searched folder and execute code with Software Center’s privileges.

Has CVE-2026-110936 been exploited in the wild?

Yes. Siemens validated that there was active exploitation of CVE-2026-110936.

How do I fix Siemens Software Center CVE-2026-110936?

Siemens recommends updating Software Center to version 4.0.9.8 or later. Existing installations update automatically the next time they start.

What is a ClickFix campaign?

ClickFix is a social engineering technique that instructs viewers to run a system command that installs malware.

Sources

  1. CISA Adds Six Known Exploited Vulnerabilities to Catalog, CISAPrimary
  2. SSA-580366, SiemensPrimary
  3. Active Exploitation of CVE-2026-110936 in Siemens Software Center - Siemens ProductCERT, SiemensPrimary
  4. ROMULUS: Analysis of a New Multi-Payload ClickFix Delivery Platform - Forescout, ForescoutPrimary
  5. Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks, SecurityWeek
  6. ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan, The Hacker News
  7. ClickFix, Wikipedia
How we checked this story
ClaimSourceStatus
SecurityWeek reported that threat actors exploited a Siemens Software Center vulnerability as part of a malware campaign.SecurityWeekAttributed
SecurityWeek said the vulnerability exists because Software Center does not properly restrict the locations it searches for DLL files.SecurityWeekAttributed
SecurityWeek said an authenticated local attacker could place a malicious DLL in a searched folder and execute code with Software Center’s privileges.SecurityWeekAttributed
SecurityWeek reported that Siemens assigned the vulnerability a CVSS v4 score of 8.4 in its 15 October advisory.Siemens, via SecurityWeekAttributed
Siemens validated that CVE-2026-110936 was actively exploited.SiemensConfirmed
Siemens fixed the weakness in Software Center version 4.0.9.8 and published advisory SSA-580366 on 15 October.SiemensConfirmed
Existing Software Center installations update automatically the next time they start.SiemensConfirmed
The Hacker News said the vulnerability has a CVSS v4 score of 8.4.The Hacker NewsAttributed
Attackers used a genuine, validly signed Siemens Software Center copy and placed malicious DLL files beside it.SiemensConfirmed
Siemens said its system, product, and update channel were not breached to its knowledge.SiemensConfirmed
Siemens linked the attacks to the Romulus multi-platform ClickFix campaign.SiemensConfirmed
ClickFix is a social engineering technique that instructs viewers to run a system command that installs malware.WikipediaConfirmed
productcert.siemens.com published its report on Oct 19, 2026.productcert.siemens.comConfirmed
forescout.com published its report on Oct 15, 2026.forescout.comConfirmed

Could not verify

  • How many organizations or devices were affected is not established
  • Whether the attackers successfully compromised Siemens customers is not established
  • Whether the Siemens campaign and all ROMULUS activity share the same operators is not established
cve
See all in Vulns & Patches →
Explore with AI
ChatGPT
Claude
Perplexity
Grok