Follow Siemens has confirmed active exploitation of a high-severity DLL side-loading vulnerability in Siemens Software Center, a desktop application used to download, install, activate, and update Siemens software. Tracked as CVE-2026-110936 and rated 8.4 under CVSS v4.0, the flaw stems from an uncontrolled DLL search path and can lead to arbitrary code execution with the privileges of the affected application.
The vulnerability has already been weaponized in ClickFix activity linked by Siemens to the Romulus delivery platform. In observed attacks, threat actors paired a legitimate, digitally signed copy of Siemens Software Center with attacker-controlled DLL files rather than modifying the Siemens executable itself. Siemens stressed that its systems, products, and official update channels were not breached.
Security teams looking for CVE-2026-110936 detection content can leverage SOC Prime’s AI-Native Detection Intelligence Platform to strengthen visibility into vulnerability exploitation, DLL side-loading, suspicious process execution, and related post-compromise behavior.
Click Explore Detections to access relevant detection content and hunt for emerging malicious activity. To Detect CVE-2026-110936 exploitation and related attack patterns, defenders should prioritize behavior-based analytics instead of relying exclusively on hashes of the signed Siemens executable.
SOC Prime detections can be applied across multiple SIEM, EDR, and Data Lake technologies and aligned with the MITRE ATT&CK® framework. Security teams can also leverage Prime Architect and Uncoder AI capabilities to transform fresh threat intelligence and indicators into hunting queries, refine detection logic, and accelerate detection engineering workflows.
CVE-2026-110936 Analysis
CVE-2026-110936 affects Siemens Software Center versions earlier than 4.0.9.8. Siemens classifies the vulnerability as CWE-427, Uncontrolled Search Path Element. The affected application can search an insufficiently restricted location for DLL files, potentially allowing an authenticated local attacker to place a specially crafted library in a searched directory and execute code with the privileges of Siemens Software Center.
The active campaign demonstrates how this weakness can be incorporated into a social-engineering-driven malware chain. Attackers distributed a genuine Siemens Software Center executable carrying a valid digital signature together with malicious DLL files. Siemens said version 3.5.8.7, the latest release at the time of the observed attacks, loaded helper files located alongside the executable without validating them first.
As a result, the legitimate Siemens executable itself was not modified. Instead, malicious functionality resided inside attacker-supplied DLL files that were loaded when Software Center started. This approach lets adversaries abuse the trust associated with a legitimately signed application while executing attacker-controlled code.
The Hacker News reports that the attack chain used msiexec.exe to launch AllMyBasic.msi, which subsequently executed SiemensSoftwareCenter.exe. Siemens identified archive.dll as one of the malicious components associated with the campaign.
Siemens has attributed the activity to Romulus, a multi-platform ClickFix delivery operation. ClickFix attacks typically present victims with deceptive prompts, such as fake CAPTCHA or verification instructions, that persuade users to copy and execute malicious commands themselves. Related Romulus activity has also been observed delivering LegionLoader and abusing legitimate signed applications from other vendors for DLL side-loading.
The supplied reports do not describe a public CVE-2026-110936 PoC. However, proof-of-concept availability is less important in this case because Siemens has already confirmed exploitation of the vulnerability in real-world attacks.
CVE-2026-110936 IOCs published by Siemens include 96.62.218[.]59, used for payload hosting and command-and-control; wizardexpensive[.]com, also associated with payload hosting and C2; and 2.27.248[.]127, which was used to distribute the malicious AllMyBasic.msi package.
The published details for CVE-2026-110936 also highlight several host artifacts that can help defenders identify compromised systems. These include SiemensSoftwareCenter.exe executing from AppData\Local\Programs, an SM Software Provisioning Service folder, files named activate.bak or statinfosta.DB beside the executable, and an FTSuite directory containing ftc.uml under AppData\Local.
Because the Siemens binary used by the attackers is genuine and digitally signed, traditional file reputation alone may fail to expose the attack. Security teams should instead correlate the executable’s location, parent process, adjacent DLL files, persistence artifacts, and outbound network connections.
CVE-2026-110936 Mitigation
Siemens addressed the vulnerability in Software Center version 4.0.9.8. All earlier versions are considered affected, and existing installations are designed to receive the patched release automatically when the application is started. Organizations should verify that deployed endpoints are running version 4.0.9.8 or newer rather than assuming the automatic update has already been completed.
Organizations should also ensure that Siemens software is obtained exclusively through official Siemens sources. The company states that the malicious bundle involved in the campaign was distributed outside its official infrastructure and that no Siemens product or update channel was compromised.
Security teams should block the known malicious infrastructure at DNS resolvers, proxies, and firewalls and retrospectively search endpoint and network telemetry for previous connections. Defenders should specifically hunt for SiemensSoftwareCenter.exe executing from AppData\Local\Programs, particularly when launched through msiexec.exe, and inspect for unexpected DLL files placed beside Siemens executables outside normal installation directories.
Hash-based monitoring of SiemensSoftwareCenter.exe alone is insufficient because the file abused by the attackers is legitimate. Detection logic should instead focus on anomalous execution paths, suspicious child or parent processes, unexpected adjacent DLLs, persistence mechanisms, and communications with known malicious infrastructure.
If indicators of compromise are identified, isolate the affected endpoint, terminate the malicious process, remove unauthorized startup entries or scheduled tasks, and reset potentially exposed passwords. Siemens also recommends reviewing historical logs for connections to both active and previously used campaign infrastructure.
FAQ
What is CVE-2026-110936 and how does it work?
CVE-2026-110936 is a high-severity DLL side-loading vulnerability in Siemens Software Center. The application can load DLLs from an uncontrolled search path, potentially allowing a locally authenticated attacker to place a crafted DLL in a searched directory and execute malicious code with the privileges of the affected application. In observed ClickFix attacks, threat actors packaged a legitimate signed Siemens executable together with malicious DLLs so the trusted application would load attacker-controlled code.
When was CVE-2026-110936 first discovered?
The supplied sources do not provide the exact date on which the vulnerability was initially discovered. Siemens publicly disclosed the flaw through advisory SSA-580366 on October 15, 2026, and credited Huntress Labs researcher Jose Oregon with reporting it. Siemens subsequently confirmed active exploitation on October 19, 2026.
What is the impact of CVE-2026-110936 on systems?
Successful exploitation can result in arbitrary code execution with the privileges of Siemens Software Center. In the observed campaign, attackers were able to abuse a trusted, digitally signed application as a carrier for malicious DLL execution, making malicious activity more difficult to distinguish from legitimate software behavior.
Can CVE-2026-110936 still affect me in 2026?
Yes. Siemens Software Center versions earlier than 4.0.9.8 remain vulnerable. The risk is particularly significant because active exploitation has already been confirmed and attackers have demonstrated that the legitimate Siemens executable can be incorporated into ClickFix-driven malware delivery chains.
How can I protect myself from CVE-2026-110936?
Update Siemens Software Center to version 4.0.9.8 or later and verify that the patched version is actually installed. Download Siemens software only from official sources, block the published malicious infrastructure, and hunt for suspicious execution of SiemensSoftwareCenter.exe from user-writable directories. Organizations should also inspect neighboring DLL files, unusual msiexec.exe activity, unexpected persistence artifacts, and historical network connections. If compromise is suspected, isolate the endpoint and follow established incident response procedures.
