Attackers paired a genuine signed Siemens Software Center 3.5.8.7 with a malicious archive.dll. CISA set a 3 November KEV deadline; the fix is V4.0.9.8.
Siemens has confirmed that attackers are exploiting CVE-2026-110936, a DLL search-path flaw in Siemens Software Center, in the wild. CISA added it to the Known Exploited Vulnerabilities catalog on 20 October 2026, with a federal remediation deadline of 3 November. Every version below V4.0.9.8 is affected. Siemens says, to its knowledge, no Siemens system, product or update channel was breached: the attackers bundled a genuine, signed copy of Software Center with their own malicious archive.dll and spread it outside Siemens' channels. Anyone who has Software Center installed, or who may have run a bundle posing as it, should check now.
What is affected
Software Center is the tool Siemens customers use to download, install and update licensed software. Siemens advisory SSA-580366 describes CWE-427 (uncontrolled search path element): the application loads DLLs from a location an attacker can write to, so a planted DLL runs with the application's privileges. Siemens scores it 8.4 under CVSS v4.0 and 6.7 under v3.1, with local access and high privileges (PR:H) required. Jose Oregon of Huntress Labs is credited with reporting it.
The advisory went out on 15 October. On 17 October Siemens added the fix, V4.0.9.8, and on 19 October the advisory's V1.2 added a reference to a Siemens blog post on active exploitation. Installed copies update on next launch. Siemens lists no product-specific workaround.
From Huntress's ClickFix report to CISA's KEV deadline: five weeks.
How it is being abused
Siemens says attackers used a genuine, validly signed and unmodified copy of Software Center, version 3.5.8.7, which was the latest release at the time. They put their own DLL, archive.dll, beside it. The vulnerable build loaded helper files from its own folder without checking them, so the DLL ran when the signed program started. The bundle, AllMyBasic.msi, was distributed outside official channels. Siemens attributes the activity to the Romulus multi-platform ClickFix campaign.
This was not a compromise of Siemens' distribution. Siemens says that, to its knowledge, no Siemens system, product or update channel was breached. What the attackers abused is the trust a signed binary carries once it sits next to a file they control.
The Hacker News reports the chain as msiexec.exe running AllMyBasic.msi, which launches SiemensSoftwareCenter.exe. That is a secondary source; Siemens' guidance to look for the executable running from AppData\Local\Programs and started by msiexec is consistent with it.
Because the binary is genuine, Siemens tells defenders to detect on folders and behaviour, not on the file's fingerprint.
Context
According to SecurityWeek, Forescout has described Romulus as delivering LegionLoader and other payloads, and found it on several servers, including the one Siemens named as distributing the malicious bundle. Who operates it is unknown.
Separately, Huntress published a report on 28 September on a ClickFix campaign that used rogue ChatGPT Custom GPTs as lures, with at least 40 related incidents. It abused signed Canon and later Stardock programs for sideloading. The Huntress report does not name Siemens. The link between the two comes from SecurityWeek, which suggests Siemens Software Center was added to the same toolkit based on overlapping infrastructure. That is SecurityWeek's inference, not a finding from Huntress or Siemens.
CISA lists ransomware use as unknown. For another recent ClickFix lure, see the fake Claude installer that swaps the command you copy.
What defenders should do
- Update to Software Center V4.0.9.8 or later by launching the application, and download Siemens software only from official Siemens sources.
- Hunt for SiemensSoftwareCenter.exe running from AppData\Local\Programs, started by msiexec, and for unexpected DLLs beside Software Center executables outside the default install folder.
- Check for signs on PCs where Software Center was never installed: a startup entry or scheduled task named "Siemens Software Center", a folder SM Software Provisioning Service under AppData\Local\Programs, activate.bak or statinfosta.DB beside the executable, or an FTSuite folder under AppData\Local containing ftc.uml.
- Block 96.62.218[.]59, wizardexpensive[.]com and 2.27.248[.]127 (the last is inactive, but earlier downloads may still be infected). Siemens publishes SHA-256 hashes for AllMyBasic.msi and archive.dll in its blog.
- If compromised: isolate the PC, stop the process first, remove the startup entry and task, reset passwords, then follow incident response.
- Train users not to paste commands from web pages into Win+R, the Run box or PowerShell.
- US federal agencies must remediate by 3 November under CISA's KEV deadline.