Siemens Software Center DLL side-loading flaw CVE-2026-110936 exploited in ClickFix attacks; update to V4.0.9.8
Siemens Software Center before V4.0.9.8 has a DLL side-loading flaw (CVE-2026-110936) that attackers are using, tied to the Romulus ClickFix campaign. Update to V4.0.9.8 or later, get Siemens software only from Siemens, and never paste web-page commands into Run or PowerShell.
Open Siemens Software Center so it updates to V4.0.9.8 or later, or download it from Siemens directly. Never paste commands from a web page into the Run box or PowerShell, and ask your IT team to check for unexpected DLLs beside Software Center files.
What’s happening
Siemens Software Center, the Windows tool for downloading and managing Siemens engineering software, loaded helper files (DLLs) from a folder without checking them. That is CVE-2026-110936, rated 6.7 on CVSS 3.1 and 8.4 on CVSS 4.0. Siemens published a fix, V4.0.9.8, with advisory SSA-580366 on 15 October 2026. On 19 October it said it had confirmed active exploitation. Attackers bundled a genuine, validly signed copy of version 3.5.8.7 with their own DLLs, so the trusted program ran their code. Siemens ties this to the Romulus multi-platform ClickFix campaign, which tricks people into running commands themselves. Siemens says none of its systems, products or update channels were breached. CISA listed the flaw as exploited on 20 October. Installed copies update automatically at next start-up. The advisory names no other workaround. Siemens lists indicators of compromise in its post, including some addresses that may already be inactive.
- What
- Flaw
- Affects
- Siemens Software Center (Windows)
- Affected
- Siemens Software Center: all versions before V4.0.9.8
- Fixed in
- V4.0.9.8
- Since
- 15 Oct 2026
- Closed
- 19 Oct 2026
Timeline
- Vendor revised
Siemens revised the advisory to V1.2, adding a pointer to its post on the active exploitation and how to detect it.
- Wider attacks
Siemens said it had validated active exploitation. Attackers paired a genuine, validly signed copy of version 3.5.8.7 with their own DLLs. Siemens links the campaign to the Romulus ClickFix campaign and says none of its systems or update channels were breached.
- New fixFixed
Siemens updated the advisory (V1.1) to add the Software Center remediation: V4.0.9.8 or later, which installed copies fetch automatically at next start-up.
- Made publicFixed
Siemens published advisory SSA-580366 for CVE-2026-110936, a DLL side-loading flaw in Siemens Software Center. Versions before V4.0.9.8 are affected. Huntress Labs' Jose Oregon reported it.
Sources
- SSA-580366: DLL Sideloading in Siemens Software CenterSiemens ProductCERT · 19 Oct 2026
- Active exploitation of CVE-2026-110936 in Siemens Software CenterSiemens ProductCERT · 19 Oct 2026