CVE-2026-110936: Siemens Software Center Uncontrolled Search Path Element Vulnerability
Siemens Software Center before V4.0.9.8 loads DLLs from an uncontrolled search path. A local attacker who can place a DLL beside the executable gets code execution as the application. Siemens reports active exploitation, with attackers pairing a genuine, signed copy of the program with malicious DLLs. Existing installations update automatically at next start to 4.0.9.8.
Published Oct 15, 2026 · Updated Oct 21, 2026 · Analysis Oct 21, 2026
What an attacker can do
This is DLL side-loading (CWE-427). Software Center loads helper libraries from its own folder without verifying them, so a DLL planted next to SiemensSoftwareCenter.exe runs with the application's privileges. The CVSS vector marks it local with high privileges required and no user interaction.
Siemens' bulletin on active exploitation describes campaigns where attackers drop their own DLLs next to a genuine, validly signed copy of the program. The executable is not modified, so file-hash detection of the program fails. Siemens attributes the activity to the Romulus multi-platform ClickFix campaign, where users are tricked into pasting commands from a web page into Win+R or PowerShell. Siemens says no Siemens system, product or update channel was breached, to its knowledge.
The result is attacker code execution on the Windows endpoint, with the delivery of payloads from attacker infrastructure.
Who is affected
Affected: Siemens Software Center, all versions below V4.0.9.8 (advisory SSA-580366). Siemens' notice cites 3.5.8.7 as the version seen at the time. It names no version check command. Open the application's about or version information, or check the installed program version in Windows settings.
Also check machines that may carry a copy of the program in a non-default folder, as the attack uses a genuine executable placed elsewhere.
How to fix it
Update to Siemens Software Center V4.0.9.8 or later. Siemens says existing installations update automatically the next time they start. Download Siemens software only from official Siemens sources.
Siemens also advises blocking the listed IP addresses and domain at firewalls, proxies and DNS. If a machine is compromised: isolate the PC, stop the process first, remove the startup entry and scheduled task, and reset passwords.
CISA's required action: apply mitigations per vendor instructions, follow BOD 26-04 and CISA's forensics triage requirements, or discontinue use if mitigations are unavailable. The due date is 2026-11-03 and binds US federal agencies.
CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
How to tell if you were hit
Siemens lists these indicators. Network: IP 96.62.218[.]59 and domain wizardexpensive[.]com (active), and IP 2.27.248[.]127 (inactive, distributed AllMyBasic.msi). SHA-256: AllMyBasic.msi f4d7c5321bb0d1bda439304a753bcf9b467b98ca53c7e9493b9c2c3451092e4a, archive.dll 3fdcc7d7d049a89711fb31fb236940a1c5a09d899143ffd20c3c41fb1f2cf491.
Files and folders: activate.bak or statinfosta.DB next to SiemensSoftwareCenter.exe; SM Software Provisioning Service under AppData\Local\Programs; FTSuite containing ftc.uml under AppData\Local. Also look for Siemens Software Center in startup apps or Task Scheduler on a PC where it was never installed, and unexpected DLLs next to its executables outside the default install folder. Detect on folder and behavior, not the program's hash.
Original advisory
From the National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.
Questions
- Is CVE-2026-110936 exploited in the wild?
Yes. Siemens published a notice on active exploitation, and CISA added it to the KEV catalog on 2026-10-20 with a due date of 2026-11-03.
- Was Siemens itself compromised?
Not to Siemens' knowledge. It says the program was not modified, and no Siemens system, product or update channel was breached. Attackers abuse a genuine copy with malicious DLLs.
- Which version fixes it?
V4.0.9.8. Siemens states that existing installations update automatically the next time the application starts.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. The analysis is written by an AI model from the sources listed above and checked by automated rules before it is published. Check versions against the vendor's advisory before you act. Methodology