Siemens Software Center Flaw Exploited in Attacks

Siemens says attackers are actively exploiting a flaw in Siemens Software Center, the Windows app its customers use to download, install, activate and update Siemens software. The criminals are bundling a genuine, signed copy of the program with malicious files and tricking people into running it. Anyone with the app installed should make sure it has updated to version 4.0.9.8.

What makes the campaign awkward to spot is that the Siemens file itself is real. Siemens says the program was not modified and that, to its knowledge, none of its systems, products or update channels were breached. The attackers instead exploited how older versions loaded helper files, and distributed their bundle outside official Siemens channels.

In brief

Siemens has confirmed active exploitation of CVE-2026-110936, a DLL side-loading flaw in Siemens Software Center, and fixed it in version 4.0.9.8.
Attackers paired a genuine signed copy of the app with their own malicious DLLs and spread it through ClickFix lures, so security tools may trust the Siemens file.
Siemens has not said how many PCs were infected; it links the activity to the Romulus ClickFix campaign.

What Siemens has confirmed

In a ProductCERT blog post on 19 October, Siemens said it “has validated that there is an active exploitation of CVE-2026-110936”. It added: “No Siemens system, product or update channel was breached to our knowledge.” The company says it is sharing intelligence with endpoint detection (EDR) vendors and authorities.

The flaw itself was disclosed on 15 October in advisory SSA-580366. According to the advisory, the app loads DLLs “from an uncontrolled search path”. That could let an authenticated local attacker plant a crafted DLL and run code with the app’s privileges. Siemens rates it 8.4 under CVSS v4.0 and 6.7 under CVSS v3.1, and credits Jose Oregon of Huntress Labs with reporting it.

All versions before 4.0.9.8 are affected. Siemens says existing installations update automatically the next time they start. The advisory added that fix on 17 October and linked the exploitation post on 19 October.

How the attack works

According to Siemens, the attackers took a genuine copy of the app with a valid digital signature and placed their own files beside it. They chose it because it is signed and trusted, and because version 3.5.8.7, the newest at the time, loaded helper files from its own folder without checking them. When the program started, it loaded the attackers’ DLLs.

The lure is ClickFix, SecurityWeek reported. These attacks use fake prompts, such as bogus CAPTCHA checks, to persuade people to paste and run malicious commands on their own computers. Siemens attributes the activity to the “Romulus multi-platform ClickFix campaign”.

SecurityWeek added context from other researchers. It said Forescout published research on Romulus last week, describing a ClickFix delivery platform that can serve several malware payloads. Forescout found it running on several servers, including the one Siemens identified as the distribution point for the malicious bundle. Forescout could not say who runs it.

Huntress has described a related technique in a separate campaign, according to SecurityWeek. In that case, signed programs from Canon and later Stardock were abused to side-load malicious code, and Huntress responded to at least 40 incidents. Those reports do not mention Siemens Software Center, but SecurityWeek says the shared infrastructure and similar method suggest the Siemens app may have been added to the same toolkit.

What to check and what to do

Siemens published indicators for defenders to block and search for in their logs:

Indicator	Status, per Siemens
96.62.218[.]59	Active: payload hosting and command and control
wizardexpensive[.]com	Active: payload hosting and command and control
2.27.248[.]127	Inactive: distributed the AllMyBasic.msi bundle

Source: Siemens ProductCERT, 19 October 2026. Indicators are defanged.

For everyday users, the advice is simple. Make sure Siemens Software Center is on version 4.0.9.8 or later, which happens when you start the app. Only download Siemens software from official Siemens sources. Never paste a command from a web page into the Windows Run box or PowerShell; Siemens notes that a real “I am not a robot” check never asks for this.

Siemens also lists signs that a PC may be infected:

“Siemens Software Center” in start-up apps or Task Scheduler on a PC that never had it installed.
A folder called “SM Software Provisioning Service” inside AppData\Local\Programs.
Files named activate.bak or statinfosta.DB next to SiemensSoftwareCenter.exe.
A folder called “FTSuite” containing ftc.uml inside AppData\Local.
Network connections to 96.62.218[.]59.

For security teams, Siemens advises looking for SiemensSoftwareCenter.exe running from AppData\Local\Programs and started by msiexec, and for unexpected DLLs next to the app outside its default install folder. Because the Siemens file is genuine, it says detection should focus on folders and behaviour, not the file’s fingerprint. If you find a compromised machine, Siemens says to isolate it, stop the process, remove the start-up entry and scheduled task, and reset passwords.

Our read

This is TSN’s analysis. This is a misuse of a trusted, signed program rather than a breach of Siemens, and Siemens patched it before it confirmed the exploitation. The bigger risk is that hash-based allowlists will keep trusting older signed copies that criminals bundle themselves. Until Siemens or the researchers say how many machines were hit, behaviour-based hunting is the best defence.