Siemens Software Center CVE-2026-110936: Exploited DLL Side-Loading Flaw Added to CISA KEV. Update to 4.0.9.8

TL;DR: Siemens says it "has validated that there is an active exploitation" of CVE-2026-110936, a DLL side-loading flaw in Siemens Software Center, the application customers use to download, install, activate and update purchased Siemens software (Siemens ProductCERT). All versions before V4.0.9.8 are affected. Siemens says existing installations "will be auto updated on next startup" (Siemens SSA-580366). CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on 20 October 2026, with a due date of 3 November 2026. Severity: High. Siemens scores it CVSS v4.0 8.4 (CVSS v3.1 6.7); NVD has not published its own score. What to do: make sure every copy of Siemens Software Center is on V4.0.9.8 or later, and hunt for the indicators Siemens published.

What lowers the urgency for most readers:

• Local, not remote. Siemens describes the flaw as letting "an authenticated local attacker" place a crafted DLL where the application looks for one. Its CVSS vector is local access with high privileges (AV:L/PR:H). It is not an internet-facing bug.
• The fix installs itself. Siemens says V4.0.9.8 is applied automatically the next time the application starts.
• Siemens says it was not breached. In Siemens' words: "No Siemens system, product or update channel was breached to our knowledge." The attackers spread the signed program with their own malicious files "outside official channels" (Siemens ProductCERT).
• Ransomware use is not established. CISA lists known ransomware campaign use as "Unknown".

The catch: the attackers brought their own genuine, signed copy of Siemens Software Center. Siemens lists the program appearing in start-up apps or Task Scheduler "of a PC that never had it installed" as a warning sign. So a machine can be affected even if your organisation has never deployed Siemens software.

Technical Information

Siemens describes CVE-2026-110936 as an uncontrolled search path element (CWE-427): "The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application."

• Siemens (CNA) CVSS v4.0: 8.4 High, CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N.
• Siemens (CNA) CVSS v3.1: 6.7 Medium, CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
• NVD: the entry is marked "Analyzed" but carries only Siemens' scores. NVD has no score of its own.
• CISA SSVC (via the CVE record): Exploitation "active", Automatable "no", Technical Impact "total".
• Reporter: Siemens credits Jose Oregon of Huntress Labs.

How the attacks worked, according to Siemens

Siemens' ProductCERT post of 19 October says the attackers "used a genuine copy of Siemens Software Center with a valid signature and placed their own files next to it." They picked it "because it is signed and trusted," and because version 3.5.8.7, the latest version at the time, loaded helper files from its own folder without checking them. "The Siemens program was not modified. The malicious code is in the DLL files the attackers supplied". Siemens attributes the activity to the "Romulus multi-platform ClickFix campaign". ClickFix lures trick people into pasting commands from a web page into the Windows Run box or PowerShell.

Forescout's Vedere Labs published research on ROMULUS, which it describes as "a new multi-payload ClickFix delivery platform", on 15 October. It lists 2.27.248[.]127, the address Siemens names as the distribution channel for the malicious bundle, among six servers it found running ROMULUS, as a "ROMULUS host not individually analyzed" (Forescout). Forescout links ROMULUS to a campaign Huntress reported on 28 September, in which attackers abused Canon- and Stardock-signed programs to side-load malicious code; Huntress says "it's highly likely other signed applications are being abused the same way" (Huntress). Neither report mentions Siemens Software Center (Rescana checked both on 22 October 2026, 16:27 Cyprus time (UTC+3)).

The CVSS vector describes only the DLL-placement step (local access). In the reported campaign, a social-engineering lure gets the victim to start the chain. Siemens has not published victim numbers or sectors, and we do not have any.

Timeline

All dates are 2026. Times are Cyprus time (UTC+3).

• 15 October: Siemens publishes SSA-580366 V1.0. The CVE record goes live on cve.org at 17:01.
• 17 October: SSA-580366 V1.1 adds the fix, V4.0.9.8.
• 19 October: SSA-580366 V1.2 links to Siemens ProductCERT's post on active exploitation, which includes indicators of compromise. The Canadian Centre for Cyber Security issues advisory AV26-1063.
• 20 October: CISA adds CVE-2026-110936 to KEV as one of six additions that day (CISA alert). The due date is 3 November 2026.
• 21 October: CISA's enrichment on the CVE record (KEV listing and SSVC) is last updated at 06:56. NVD marks the entry "Analyzed" at 16:10.
• 22 October, 16:16: Rescana checks the live KEV feed (catalogVersion 2026.10.21), NVD and cve.org.

CISA KEV status (live feed, catalogVersion 2026.10.21, checked 22 October 2026, 16:16 Cyprus time (UTC+3))

• Listed as: "Siemens Software Center Uncontrolled Search Path Element Vulnerability"
• Date added: 2026-10-20
• Due date: 2026-11-03
• Known ransomware campaign use: Unknown
• Required action (CISA): "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA's 'Forensics Triage Requirements' (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable."

CISA says BOD 26-04 "establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies". Under it, an agency's deadline depends on whether the affected asset is publicly exposed as well as on KEV status and CISA's SSVC values; for a KEV-listed flaw rated not automatable with total technical impact, as here, the directive's table sets 3 days plus forensic triage for publicly exposed assets and 14 days for others. CISA adds: "While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities" (CISA alert).

Affected Product Versions

Source: Siemens SSA-580366, V1.2, last updated 19 October 2026. The version Siemens says the attackers used was 3.5.8.7. Siemens' download page offers Software Center for Windows and Linux; SSA-580366 does not limit the affected versions to one platform. The warning signs and advice in Siemens' exploitation post refer to Windows PCs (for example AppData folders and the Win+R Run box).

Workaround and Mitigation

Siemens has not published a workaround other than updating. Its recommendations (Siemens ProductCERT):

1. Update to V4.0.9.8 or later. "Starting the application installs the update automatically." The current version is also available from Siemens' Software Center page. Check that machines where the application rarely runs have actually picked up the update. (This check is Rescana guidance.)
2. Get Siemens software only from official Siemens sources. The attackers spread the signed program with their malicious files outside official channels.
3. Block the published indicators (see below) on firewalls, proxies and DNS resolvers, and search your logs for them, including the inactive distribution address.
4. Hunt on behaviour, not on the Siemens file. Siemens says: "Detect on folder and behaviour, not on the Siemens file fingerprint: the file itself is genuine". Look for SiemensSoftwareCenter.exe running from AppData\Local\Programs and started by msiexec, and for unexpected DLL files next to Siemens Software Center executables outside the default installation folder.
5. If you find a hit, Siemens advises: isolate the PC, stop the process first, then remove the start-up entry and scheduled task, and reset passwords. Then follow your incident response process.
6. Train users on ClickFix lures. Siemens: "Never paste a command from a web page into Win+R, the Run box or PowerShell. A real 'I am not a robot' check never asks for this."

Indicators of Compromise

Siemens ProductCERT published these indicators on 19 October 2026 (defanged as published; the status shown is Siemens' status at publication):

Siemens notes that "Active indicators were still reachable when this post was published", and that although the inactive distribution channel no longer serves files, "systems that downloaded from it before it went offline may still be infected".

Host warning signs listed by Siemens:

• "Siemens Software Center" in the start-up apps or Task Scheduler of a PC that never had it installed
• A folder called SM Software Provisioning Service inside AppData\Local\Programs
• Files named activate.bak or statinfosta.DB next to SiemensSoftwareCenter.exe
• A folder called FTSuite containing a file ftc.uml inside AppData\Local
• Network connections to 96.62.218[.]59

CISA and the Canadian Centre for Cyber Security have not published separate indicators. Siemens did not map the activity to MITRE ATT&CK techniques, and we have not done so either.

Questions for your vendors

Running Siemens Software Center does not mean a supplier is compromised, but it is worth asking (Rescana guidance):

• Do you run Siemens Software Center or other Siemens software-management tooling, on engineering workstations or elsewhere?
• Is every install on V4.0.9.8 or later, and how have you confirmed the automatic update took?
• Do you obtain vendor software only from official vendor channels?
• Have you searched for the indicators and host artefacts Siemens published on 19 October?

What we will update: We will update this post if Siemens revises SSA-580366 or publishes new indicators, if CISA issues an ICS advisory or changes the KEV entry (including the ransomware field), or if NVD publishes its own score.

Sources

• Siemens ProductCERT, SSA-580366: DLL Sideloading Vulnerability in Siemens Software Center (V1.0 15 Oct 2026; V1.2 19 Oct 2026): https://cert-portal.siemens.com/productcert/html/ssa-580366.html
• Siemens ProductCERT, "Active Exploitation of CVE-2026-110936 in Siemens Software Center" (19 Oct 2026): https://productcert.siemens.com/news/2026/10/19/active-exploitation-of-cve-2026-110936-in-siemens-software-center/
• CISA: Known Exploited Vulnerabilities catalog entry https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-110936; alert, "CISA Adds Six Known Exploited Vulnerabilities to Catalog" (20 Oct 2026) https://www.cisa.gov/news-events/alerts/2026/10/20/cisa-adds-six-known-exploited-vulnerabilities-catalog; BOD 26-04 https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
• CVE and NVD records: cve.org https://www.cve.org/CVERecord?id=CVE-2026-110936; NVD https://nvd.nist.gov/vuln/detail/CVE-2026-110936
• Canadian Centre for Cyber Security, Siemens security advisory AV26-1063, Update 1 (19–20 Oct 2026): https://www.cyber.gc.ca/en/alerts-advisories/siemens-security-advisory-av26-1063
• Researcher reports: Forescout Vedere Labs, "ROMULUS: Analysis of a New Multi-Payload ClickFix Delivery Platform" (15 Oct 2026) https://www.forescout.com/blog/romulus-analysis-of-a-new-multi-payload-clickfix-delivery-platform/; Huntress, "Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix" (28 Sep 2026) https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat

Siemens Software Center is the tool that delivers and updates Siemens software, and in this campaign attackers abused trust in a genuine, signed copy of it, which is hard to see from outside. Your suppliers, including OT and engineering integrators that work with Siemens tooling, may run it without listing it anywhere.

Forward this to your TPRM owner: If any supplier or OT integrator uses Siemens software, ask them today whether Siemens Software Center is on V4.0.9.8 or later and whether they have hunted for Siemens' published indicators (Rescana guidance).

Want a fast, evidence-based view of which vendors in your supply chain are exposed to flaws like this, and how quickly they respond? Book a demo.