Siemens Software Center CVE-2026-110936: exploited in ClickFix attacks, in CISA KEV since Oct 20

What happened

Attackers used a genuine, signed copy of Siemens Software Center to run their own malware on Windows PCs. The flaw is CVE-2026-110936.

This is not breaking news. Here is when each step became public:

• October 15, 2026: Siemens published advisory SSA-580366.
• October 17: Siemens added the fixed version, 4.0.9.8.
• October 19: Siemens confirmed active exploitation in a ProductCERT blog post.
• October 20: CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog.

Siemens rates it CVSS 4.0 8.4 (High).

The flaw

Siemens Software Center is the Windows app Siemens customers use to download, install, activate and update their Siemens software.

Older versions load helper DLLs from an uncontrolled search path (CWE-427). If a malicious DLL sits in a folder the app searches, the app loads it. The code then runs with the app's privileges.

On paper, Siemens describes this as a local attack by an authenticated user. In practice, the attackers did not need a foothold first. They tricked victims into running the bundle themselves.

How the attack worked

Siemens says the attackers brought their own copy of the app. It was version 3.5.8.7, the newest release at the time, with a valid Siemens signature. They placed malicious DLLs next to it.

The signed app is a trusted carrier. Security tools are less likely to block it. When it starts, it loads the attackers' DLL.

Delivery used ClickFix. Victims see a fake check, such as an "I am not a robot" prompt. It tells them to paste a command into the Run box or PowerShell. That command installs an MSI bundle, which launches the signed Siemens app.

Siemens links the campaign to Romulus, a ClickFix delivery platform. Forescout described Romulus on October 15. It found the same platform serving other side-loading bundles built on signed Stardock software. Forescout could not say who runs it.

Siemens says none of its systems, products or update channels were breached. The Siemens program itself was not modified.

The key twist

Updating your own copy is not enough on its own.

The attackers carry an old, vulnerable copy onto the PC. A machine that never had Siemens Software Center can still be hit. That is why Siemens tells defenders to hunt by folder and behavior. The Siemens file in the attack is genuine, so its fingerprint will look clean.

What CISA says

CISA added CVE-2026-110936 on October 20, with five other flaws. That batch included four Plex Media Server bugs and SiteGuard Server Edition CVE-2026-106931.

• Due date for US federal agencies: November 3, 2026.
• Known ransomware use: unknown.
• Required action: apply Siemens' fix under BOD 26-04, or stop using the product if no fix is possible.

We found no separate CISA ICS advisory for this flaw. The UK's NHS England Digital issued its own alert. It rates further exploitation as highly likely.

What is not known

• Victim count. Siemens has not said how many PCs were infected.
• Final payload. Siemens does not name the malware family. Earlier Romulus bundles led to remote access trojans and loaders.
• Who is behind it. Neither Siemens nor Forescout has named an operator.
• Public PoC. We found none. A GitHub repository named after the CVE is a threat-hunting notebook, not exploit code. ThreatWire did not run it.

The flaw was reported by Jose Oregon of Huntress Labs.

Indicators, at a high level

Siemens published these indicators. They are defanged:

• 96.62.218[.]59: payload hosting and command and control. Active when Siemens published.
• wizardexpensive[.]com: payload hosting and command and control. Active when Siemens published.
• 2.27.248[.]127: distribution server for a bundle named AllMyBasic.msi. Now inactive.

Siemens also lists file hashes for the MSI and the malicious DLL. Use its post for the full list.

Warning signs Siemens lists on a PC:

• "Siemens Software Center" in startup apps or scheduled tasks on a PC that never had it.
• A folder named SM Software Provisioning Service under the user's local AppData Programs folder.
• Files named activate.bak or statinfosta.DB next to the Siemens executable.
• A folder named FTSuite under local AppData.

What to do now

1. Update Siemens Software Center to 4.0.9.8 or later. Starting the app installs the update. Check the version afterwards.
2. Hunt for stray copies. Look for the Siemens executable running from a user's AppData folder, especially when launched by the Windows installer.
3. Detect behavior, not the file. Alert on unexpected DLLs next to signed apps in user-writable folders. Do not rely on the Siemens file hash.
4. Block and search for Siemens' indicators in firewall, proxy and DNS logs. Include the inactive distribution server.
5. Train users on ClickFix. No real CAPTCHA asks you to paste a command into Run or PowerShell.
6. Only install Siemens software from official Siemens sources.
7. If you find an infected PC, isolate it. Stop the process, remove the startup entry and scheduled task, and reset the user's passwords. Then follow your incident response process.
8. Federal agencies: remediate by November 3, 2026, per the KEV entry.

Related coverage

Full record: CVE-2026-110936 on ThreatWire.

Also added to KEV on October 20: SiteGuard Server Edition CVE-2026-106931 and the Plex2Shell chain. Browse actively exploited CVEs and the CVE tracker.

Sources: Siemens ProductCERT advisory SSA-580366 and its exploitation post, CISA's KEV catalog and alert, CVE.org, NVD, the GitHub Advisory Database, NHS England Digital, Forescout, SecurityWeek and The Hacker News. Links are in the references list.