Siemens Software Center: DLL sideloading via uncontrolled search path

Summary

Siemens Software Center loads dynamic-link libraries from an uncontrolled search path. An authenticated local attacker with high privileges can place a specially crafted DLL in a directory the application searches, executing code with the application's privileges. Siemens has validated active exploitation in a ClickFix campaign that used a genuine, signed Software Center build with malicious DLLs placed next to it.

Affected

• Siemens Software Center, all versions before V4.0.9.8

Fixed in

• Version V4.0.9.8 or later. Existing installations update automatically on the next start.

Workaround

• Unknown. Siemens publishes no workaround; apply the fixed version.

Exploitation

• Actively exploited in the wild, validated by Siemens on 19 October 2026.
• Added to the CISA Known Exploited Vulnerabilities catalog on 20 October 2026.
• Attributed by Siemens to the Romulus multi-platform ClickFix campaign. Attackers used a signed Software Center build (reported as 3.5.8.7) with malicious DLLs, distributed outside official channels.
• Public proof of concept: unknown.

Our recommendation

• Update Siemens Software Center to V4.0.9.8 or later on all endpoints and verify that the update has been applied.
• Download Siemens software only from official Siemens sources.
• Search for SiemensSoftwareCenter.exe running from AppData\Local\Programs or started by msiexec, and for unexpected startup entries or scheduled tasks on machines that never had the software installed.
• Block 96.62.218[.]59, wizardexpensive[.]com and 2.27.248[.]127 on firewalls, proxies and DNS, and search logs for connections to them.
• If compromise is suspected, isolate the system, stop the process, remove persistence entries and reset passwords.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  DAS-Bodhi/CVE-2026-110936-Siemens-Attack

Research sources

• Siemens SSA-580366 Security Advisory cert-portal.siemens.com
• Siemens ProductCERT: Active Exploitation of CVE-2026-110936 productcert.siemens.com
• CISA Known Exploited Vulnerabilities Catalog www.cisa.gov
• Help Net Security: Exploitation of Siemens Software Center vulnerability www.helpnetsecurity.com
• GBHackers: Hackers exploit Siemens Software Center vulnerability gbhackers.com
• UK NHS Cyber Alert CC-4874 digital.nhs.uk
• Canadian Centre for Cyber Security: Siemens Security Advisory AV26-1063 www.cyber.gc.ca

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 13:42.