{"id":"siemens-software-center-dll-sideload-oct-2026","category":"patch","status":"closed","title":"Siemens Software Center DLL side-loading flaw CVE-2026-110936 exploited in ClickFix attacks; update to V4.0.9.8","tldr":"Siemens Software Center before V4.0.9.8 has a DLL side-loading flaw (CVE-2026-110936) that attackers are using, tied to the Romulus ClickFix campaign. Update to V4.0.9.8 or later, get Siemens software only from Siemens, and never paste web-page commands into Run or PowerShell.","summary":"Siemens Software Center, the Windows tool for downloading and managing Siemens engineering software, loaded helper files (DLLs) from a folder without checking them. That is CVE-2026-110936, rated 6.7 on CVSS 3.1 and 8.4 on CVSS 4.0. Siemens published a fix, V4.0.9.8, with advisory SSA-580366 on 15 October 2026. On 19 October it said it had confirmed active exploitation. Attackers bundled a genuine, validly signed copy of version 3.5.8.7 with their own DLLs, so the trusted program ran their code. Siemens ties this to the Romulus multi-platform ClickFix campaign, which tricks people into running commands themselves. Siemens says none of its systems, products or update channels were breached. CISA listed the flaw as exploited on 20 October. Installed copies update automatically at next start-up. The advisory names no other workaround. Siemens lists indicators of compromise in its post, including some addresses that may already be inactive.","action":"Open Siemens Software Center so it updates to V4.0.9.8 or later, or download it from Siemens directly. Never paste commands from a web page into the Run box or PowerShell, and ask your IT team to check for unexpected DLLs beside Software Center files.","product":"Siemens Software Center (Windows)","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-110936"],"tags":["siemens","software-center","dll-sideloading","clickfix","romulus","exploited","windows","cisa-kev"],"affected":["Siemens Software Center: all versions before V4.0.9.8"],"fixed":["V4.0.9.8"],"matches":[],"sources":[{"kind":"advisory","title":"SSA-580366: DLL Sideloading in Siemens Software Center","url":"https://productcert.siemens.com/productcert/html/ssa-580366.html","by":"Siemens ProductCERT","date":"2026-10-19"},{"kind":"advisory","title":"Active exploitation of CVE-2026-110936 in Siemens Software Center","url":"https://productcert.siemens.com/news/2026/10/19/active-exploitation-of-cve-2026-110936-in-siemens-software-center/","by":"Siemens ProductCERT","date":"2026-10-19"}],"started":"2026-10-15","closed":"2026-10-19","created":"2026-11-03T21:55:09.843Z","updated":"2026-11-03T21:55:09.843Z","cve_notes":[{"cve":"CVE-2026-110936","name":"DLL side-loading in Siemens Software Center","what":"Siemens Software Center loads DLLs from an uncontrolled search path, so someone who can place a crafted DLL in a searched folder can run code with the application's privileges; Siemens confirms it is being exploited.","severity":"high","cvss":6.7}],"timeline":[{"at":"2026-10-19","added":"2026-11-03T21:54:15.158Z","kind":"vendor-revised","text":"Siemens revised the advisory to V1.2, adding a pointer to its post on the active exploitation and how to detect it.","url":"https://productcert.siemens.com/productcert/html/ssa-580366.html","by":"Siemens ProductCERT","patch":null},{"at":"2026-10-19","added":"2026-11-03T21:54:15.158Z","kind":"wider-attacks","text":"Siemens said it had validated active exploitation. Attackers paired a genuine, validly signed copy of version 3.5.8.7 with their own DLLs. Siemens links the campaign to the Romulus ClickFix campaign and says none of its systems or update channels were breached.","url":"https://productcert.siemens.com/news/2026/10/19/active-exploitation-of-cve-2026-110936-in-siemens-software-center/","by":"Siemens ProductCERT","patch":null},{"at":"2026-10-17","added":"2026-11-03T21:54:15.158Z","kind":"new-fix","text":"Siemens updated the advisory (V1.1) to add the Software Center remediation: V4.0.9.8 or later, which installed copies fetch automatically at next start-up.","url":"https://productcert.siemens.com/productcert/html/ssa-580366.html","by":"Siemens ProductCERT","patch":"patched"},{"at":"2026-10-15","added":"2026-11-03T21:54:15.158Z","kind":"disclosed","text":"Siemens published advisory SSA-580366 for CVE-2026-110936, a DLL side-loading flaw in Siemens Software Center. Versions before V4.0.9.8 are affected. Huntress Labs' Jose Oregon reported it.","url":"https://productcert.siemens.com/productcert/html/ssa-580366.html","by":"Siemens ProductCERT","patch":"patched"}],"url":"https://hard.fyi/live/siemens-software-center-dll-sideload-oct-2026/","json":"https://hard.fyi/api/live?id=siemens-software-center-dll-sideload-oct-2026"}