CVE-2026-110936

What is Siemens Software Center?

Siemens Software Center is the desktop client that Siemens customers use to find, download, install, and update Siemens software. It covers the industrial and engineering portfolio, including products such as TIA Portal, NX, and Solid Edge, and it handles entitlement checks and version management for them. In practice it is installed on engineering workstations, OT support laptops, and the PCs of anyone who maintains Siemens automation or PLM software.

Two properties make it attractive to an attacker. It is signed by Siemens and therefore trusted by users, allowlists, and some security tooling. And it lives on exactly the machines that hold access to industrial control networks and engineering projects. In this campaign the attackers were interested in the first property: a correctly signed, genuine Siemens executable makes an excellent carrier for someone else's code.

Overview

CVE-2026-110936 is an uncontrolled search path element issue in Siemens Software Center. The application loads DLLs from its own directory without validating them, so anyone who can place a file beside the executable can have that file loaded and executed with the privileges of the application. Siemens classifies it as DLL side-loading and scores it CVSS v3.1 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and CVSS v4.0 8.4.

Read as a conventional local privilege escalation the score looks modest, and that framing understates it. Attackers are not using the flaw to escalate on machines where Software Center was already installed. They are shipping their own copy of the genuine, validly signed Software Center executable to victims who never used Siemens software at all, dropping a malicious archive.dll next to it, and letting the signed binary load their payload for them. The vulnerability is being used as a proxy execution and defence evasion technique rather than as a privilege escalation.

Siemens published SSA-580366 on 2026-10-15, updated it on 2026-10-17 to name V4.0.9.8 as the fix, and on 2026-10-19 published a separate ProductCERT blog confirming validated active exploitation and releasing indicators. Siemens states explicitly that no Siemens system, product, or official update channel was breached: the attackers simply redistributed a legitimate binary. CISA added the CVE to KEV on 2026-10-20 with a deadline of 2026-11-03.

Affected Versions

Existing legitimate installations update themselves to V4.0.9.8 on next startup, so the patching burden for genuine users is small. The harder problem is the attacker-supplied copies, which do not update and are not meant to.

Technical Details

The CWE is CWE-427, uncontrolled search path element. In plain words, the program asks Windows for a library by name and takes whatever the search order hands back, without pinning the load to a known-good directory or checking that the file is signed by the expected publisher. Since the application's own folder sits early in the default DLL search order, a file dropped next to the executable wins.

The exploitation is a single step with no complexity: write archive.dll into the same folder as SiemensSoftwareCenter.exe and start the executable. The DLL's entry point runs in the process of a signed Siemens binary, which is the whole point. There is no memory corruption, no race, and nothing version-specific to tune.

CVSS marks privileges required as High because, in the intended threat model, writing into a Program Files installation directory needs administrative rights. The campaign sidesteps that model entirely by installing its own copy under AppData\Local\Programs, a per-user path that an ordinary user can write to. That is why a 6.7 ended up in KEV.

Discovery

The vulnerability was reported to Siemens by Jose Oregon of Huntress Labs, who is credited in SSA-580366. The broader delivery infrastructure was analysed separately by Forescout Vedere Labs, which identified a panel named ROMULUS running on six IP addresses and described it as a reusable multi-payload ClickFix delivery backend rather than a single hard-coded malware server. One of those addresses, 2.27.248.127, is the host Siemens lists as the distribution point for the malicious AllMyBasic.msi bundle.

Exploitation Context

Siemens has validated active exploitation and attributes it to the Romulus multi-platform ClickFix campaign. ClickFix is the social engineering pattern where a web page instructs the visitor to paste a command into the Windows Run dialog or a PowerShell prompt, usually framed as a fix for a broken video or a CAPTCHA. Because the user runs the command themselves, there is no download prompt and no opened attachment. The pasted command fetches AllMyBasic.msi, which installs the genuine signed Software Center executable together with archive.dll into AppData\Local\Programs\SM Software Provisioning Service, and persistence is established through a startup entry or scheduled task. Reported follow-on payloads include a PowerShell stager and LegionLoader, which harvests data stored in Chrome.

Published indicators: active payload hosting and C2 at 96.62.218.59 and wizardexpensive.com; the now-inactive distribution IP 2.27.248.127; SHA-256 f4d7c5321bb0d1bda439304a753bcf9b467b98ca53c7e9493b9c2c3451092e4a for AllMyBasic.msi and 3fdcc7d7d049a89711fb31fb236940a1c5a09d899143ffd20c3c41fb1f2cf491 for archive.dll; the companion files activate.bak and statinfosta.DB; and a folder FTSuite containing ftc.uml under AppData\Local. Siemens has not published victim counts, and no ransomware use has been reported. Note that Siemens customers are not the only people at risk here: because the lure is generic, the strongest signal is a Siemens Software Center entry on a PC where Siemens software was never installed.

Remediation

1. Update Siemens Software Center to V4.0.9.8 or later. Legitimate installations auto-update at next start, but confirm the version rather than assuming it happened.
2. Search the estate for SiemensSoftwareCenter.exe running from AppData\Local\Programs, especially when the parent process is msiexec. Any copy outside the default installation path should be treated as malicious regardless of its valid signature.
3. Hunt for the published indicators: archive.dll, activate.bak, and statinfosta.DB beside a Software Center executable, the SM Software Provisioning Service and FTSuite folders, and the file hashes listed above.
4. Block and alert on 96.62.218.59, wizardexpensive.com, and 2.27.248.127, and search proxy, DNS, and firewall logs retrospectively for them.
5. Build detections on location and behaviour, not on the Siemens file signature or hash. The executable is genuine, so reputation-based controls will pass it.
6. Look for "Siemens Software Center" entries in startup apps or Task Scheduler on machines where Siemens software was never installed, which is the clearest sign of this campaign.
7. On a confirmed compromise, isolate the host, stop the running process before removing the startup entry and scheduled task, then reset the user's credentials and any browser-stored secrets, since LegionLoader targets Chrome data.
8. Reduce the lure's effectiveness: train users never to paste commands from a web page into the Run dialog or PowerShell, and consider restricting the Run dialog and msiexec execution from user-writable paths via policy.
9. Federal civilian agencies must remediate by 2026-11-03 under BOD 22-01.