Security Digest · Oct 15, 2026 · Vulnerability · Other
Siemens Software Center DLL Flaw Abused in ClickFix Attacks
Signed Siemens Software Center before 4.0.9.8 loads attacker DLLs; abused by ClickFix malware, in CISA KEV Oct 20. Installs auto-update; hunt for the IoCs.
Our verdict
Check exposure
Siemens users get the fix automatically, but the real threat is attackers shipping their own signed, older copy as a malware loader, so Windows defenders should block the indicators and hunt rather than rely on patching.
Who must act: Security teams with Windows endpoints, since attackers bring the vulnerable signed program themselves, and organizations that run Siemens Software Center for Siemens engineering software.
Who can relax: Teams with no Windows endpoints; Siemens Software Center users whose installs have updated to 4.0.9.8 or later and whose hunts find none of the indicators.
- Affected
- Siemens Software Center, all versions before V4.0.9.8 (version 3.5.8.7 was abused in the campaign)
- Fixed in
- Siemens Software Center V4.0.9.8 (installed automatically on next startup)
- CVSS
- 8.4 (v4.0, vendor)
- EPSS
- 0.3% (percentile 17)
- CISA KEV
- Yes, listed as known exploited
- Exploitation
- Exploited in the wild
- Severity
- High
What to do
- Start Siemens Software Center on every machine that has it so it auto-updates to 4.0.9.8 or later, and confirm the version.
- Block 96.62.218[.]59, wizardexpensive[.]com and 2.27.248[.]127 on firewalls, proxies and DNS resolvers.
- Hunt for SiemensSoftwareCenter.exe running from AppData\Local\Programs or launched by msiexec, and for Siemens Software Center startup entries on PCs that never had it.
- Detect on folder and behavior, not on the Siemens file hash; the abused executable is genuine and validly signed.
- Train users never to paste commands from a web page into Win+R, the Run box or PowerShell.
How to check if you are affected or compromised
- Look for an SM Software Provisioning Service folder in AppData\Local\Programs, or an FTSuite folder containing ftc.uml in AppData\Local.
- Look for activate.bak or statinfosta.DB next to SiemensSoftwareCenter.exe, or unexpected DLLs beside it outside the default install folder.
- Search proxy, DNS and EDR logs for connections to 96.62.218[.]59, wizardexpensive[.]com and 2.27.248[.]127.
- Match files against SHA-256 f4d7c5321bb0d1bda439304a753bcf9b467b98ca53c7e9493b9c2c3451092e4a (AllMyBasic.msi) and 3fdcc7d7d049a89711fb31fb236940a1c5a09d899143ffd20c3c41fb1f2cf491 (archive.dll).
What happened#
Siemens Software Center is the Windows tool that downloads, installs, activates and updates Siemens software. On October 15, 2026, Siemens published SSA-580366, a DLL sideloading flaw tracked as CVE-2026-110936 (CWE-427). Versions before 4.0.9.8 load DLLs from an uncontrolled search path. Anyone who can place a crafted DLL where the program looks can run code inside that trusted, signed process. Jose Oregon of Huntress Labs reported the issue. Siemens scores it CVSS 4.0 8.4 and CVSS 3.1 6.7. The 3.1 vector assumes local access with high privileges, which keeps the score in the medium range.
The advisory was updated on October 17 with the remediation and again on October 19 with a link to a Siemens blog post confirming active exploitation. According to Siemens, attackers took a genuine, validly signed copy of version 3.5.8.7, then the latest release, and shipped it next to their own malicious DLLs in a bundle. When the program started, it loaded the attackers' files without checking them. Siemens says its program was not modified and that "No Siemens system, product or update channel was breached to our knowledge." It attributes the activity to the Romulus multi-platform ClickFix campaign. ClickFix lures trick users into pasting a command into the Windows Run box or PowerShell. CISA added the CVE to KEV on October 20 in a six-CVE batch, with a November 3 federal deadline.
Who is affected#
All Siemens Software Center versions before 4.0.9.8 are affected, per the advisory and the CVE record. Existing installations update automatically the next time they start. The bigger point is that this campaign does not need you to run Siemens software at all. The attackers bring the vulnerable signed executable with them, so any Windows PC whose user can be talked into running their command is a potential target. SecurityWeek notes that Huntress had earlier tracked a ClickFix campaign that abused signed Canon and Stardock programs the same way, in at least 40 incidents. Forescout found Romulus infrastructure on the server Siemens identified as the bundle's distribution point. Neither report names Siemens Software Center itself.
Do you really need to act?#
Patching here is easy and mostly automatic, but it is not the main defense. A fixed 4.0.9.8 on your engineers' laptops does not stop an attacker from dropping an old, still-signed 3.5.8.7 into a user's AppData folder. Siemens itself tells defenders to "Detect on folder and behaviour, not on the Siemens file fingerprint." In practice:
- SOC and endpoint teams: load the indicators and behavior hunts this week. This is a live malware delivery chain.
- Siemens Software Center users: launch it once so it updates, and confirm the version.
- Everyone else: no patch to apply. ClickFix awareness and application control matter more than this CVE.
What to do now#
- On machines with Siemens Software Center, start the application to trigger the update to 4.0.9.8 or later, then check the version in the app or in installed programs.
- Block
96.62.218[.]59,wizardexpensive[.]comand2.27.248[.]127on firewalls, proxies and DNS resolvers. Siemens lists the first two as active payload hosting and command-and-control infrastructure. - Hunt with EDR for
SiemensSoftwareCenter.exerunning fromAppData\Local\Programsor started bymsiexec.exe, and for "Siemens Software Center" startup items or scheduled tasks on PCs that never had it installed. - If you find it, isolate the PC, stop the process first, then remove the startup entry and task and reset the user's passwords, following Siemens' order of operations.
- Remind users that a real "I am not a robot" check never asks them to paste commands into Win+R or PowerShell.
How to tell if you were hit#
Siemens lists these warning signs: an SM Software Provisioning Service folder under AppData\Local\Programs, an FTSuite folder containing ftc.uml under AppData\Local, and files named activate.bak or statinfosta.DB next to SiemensSoftwareCenter.exe. Also check for connections to the IP addresses and domain above, including the now-inactive distribution server, because PCs that downloaded the bundle earlier may still be infected. File hashes help for the attacker-supplied pieces: AllMyBasic.msi (SHA-256 f4d7c532…92e4a) and archive.dll (3fdcc7d7…cf491; full hashes are in the detection list). The Siemens executable itself is genuine, so a hash match on it means nothing. Its location and parent process are what matter.
Timeline#
- — Siemens publishes SSA-580366, and the CVE is published.
- — The advisory is updated with the 4.0.9.8 remediation.
- — Siemens confirms active exploitation and publishes indicators.
- — CISA adds CVE-2026-110936 to KEV.
- — Federal remediation deadline.
Vulnerability records
- CVE-2026-110936 · KEV 2026-10-20 · A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8).
Sources
Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.
Original and primary sources
- Siemens ProductCERT — SSA-580366: DLL Sideloading Vulnerability in Siemens Software Center cert-portal.siemens.com
- Siemens ProductCERT — Active Exploitation of CVE-2026-110936 in Siemens Software Center (Oct 19, 2026) productcert.siemens.com
- CVE record — CVE-2026-110936 cve.org
- NVD — CVE-2026-110936 nvd.nist.gov
- CISA — Known Exploited Vulnerabilities: CVE-2026-110936 cisa.gov
- CISA — CISA Adds Six Known Exploited Vulnerabilities to Catalog (Oct 20, 2026) cisa.gov