Pulp-style warning robot with a glass dome and a red beacon

Siemens Software Center CVE-2026-110936: attackers bring their own signed old copy

ALERT · Actively exploited. Last updated 26 October 2026. See the Alert Tracker

This is less a Siemens patching story than a malware campaign. Attackers ship a genuine, signed old copy of Siemens Software Center with malicious DLLs beside it, so PCs that never had Siemens software installed can be hit. Patching your own copy does not protect you; hunting does.

What it is

Local DLL sideloading: an authenticated local attacker with high privileges (CVSS 4.0 PR:H) can plant a DLL that Software Center loads. In the wild, attackers have shipped a genuine, signed old copy of Software Center (3.5.8.7) together with malicious DLLs, through a ClickFix-style lure (Siemens attributes it to the ‘Romulus’ campaign). PCs that never had Siemens software installed can be hit.

Siemens fixed the flaw in V4.0.9.8 and published advisory SSA-580366 (opens in a new tab) on 15 October. The advisory links Siemens ProductCERT’s own post confirming active exploitation (opens in a new tab), published on 19 October. Siemens says the program itself was not modified and, to its knowledge, no Siemens system, product or update channel was breached. The malicious code is in the DLLs the attackers supplied.

A ClickFix lure is a fake web check, such as an “I am not a robot” page, that tells the visitor to paste a command into the Run box or PowerShell. CISA added CVE-2026-110936 to the Known Exploited Vulnerabilities catalogue (opens in a new tab) on 20 October, the same day as SiteGuard Server Edition, with a federal due date of 3 November.

Scores

  • Severity: High (CVSS 4.0 8.4; CVSS 3.1 6.7 Medium), both from Siemens as the CNA and shown unchanged on NVD (opens in a new tab). The high-privilege requirement keeps the scores down; the campaign is the reason to act.

Why patching is not enough

Existing installations of Software Center update themselves to V4.0.9.8 the next time they start, so update anything you run. But that only fixes copies that are already installed. The attackers bring their own vulnerable, signed copy, so the defence is detection and user behaviour.

Detect on behaviour and location, not on the Siemens file hash. The Siemens file is genuine, so a hash block on it will miss this or break real installs.

What to hunt for

  • SiemensSoftwareCenter.exe running from AppData\Local\Programs and started by msiexec.
  • A folder named SM Software Provisioning Service inside AppData\Local\Programs.
  • Files named activate.bak or statinfosta.DB next to SiemensSoftwareCenter.exe.
  • A folder AppData\Local\FTSuite containing ftc.uml.
  • An unexpected Siemens Software Center entry in start-up apps or Task Scheduler, especially on a PC that never had it installed.
  • Unexpected DLL files next to Siemens Software Center executables outside the default installation folder.

Indicators

From Siemens ProductCERT’s post:

  • 96.62.218[.]59: active, payload hosting and command and control.
  • wizardexpensive[.]com: active, payload hosting and command and control.
  • 2.27.248[.]127: inactive, the distribution channel for the malware bundle. It no longer serves files, but machines that downloaded from it may still be infected, so search your logs for it.
  • AllMyBasic.msi, SHA-256 f4d7c5321bb0d1bda439304a753bcf9b467b98ca53c7e9493b9c2c3451092e4a
  • archive.dll, SHA-256 3fdcc7d7d049a89711fb31fb236940a1c5a09d899143ffd20c3c41fb1f2cf491

Block the active IP address and domain on firewalls, proxies and DNS resolvers, and search proxy, DNS and endpoint logs for all three.

If you find it

  • Isolate the PC.
  • Stop the process first, then remove the start-up entry and the scheduled task.
  • Reset the passwords of the accounts used on that PC.
  • Follow your incident response process.

What to tell users

  • Never paste a command from a web page into the Run box, Win+R or PowerShell. A real “I am not a robot” check never asks for this.
  • Download Siemens software from official Siemens sources only.

Use with care. These queries, indicators and scripts are provided as-is, for defensive use on systems you own or are authorised to test. Test and tune them before you use them in production. Indicators age quickly, so check the date and source before you block on one. Nothing here authorises access to systems that aren’t yours. Doing so may be an offence under the Computer Misuse Act 1990. Full terms.

Sources

Follow Cyber-Threat.net RSSFeedly (opens in a new tab)X (opens in a new tab)Bluesky (opens in a new tab)LinkedIn (opens in a new tab)