Siemens ProductCERT said on Oct 19 that it has validated active exploitation of CVE-2026-110936 (CVSS 3.1 6.7), a DLL side-loading weakness in Siemens Software Center, its Windows app for installing Siemens software. Advisory SSA-580366 (published Oct 15, updated Oct 19) covers all versions before 4.0.9.8; existing installs update automatically on next start. Attackers took a genuine, validly signed copy of Siemens Software Center (version 3.5.8.7, which loaded helper DLLs from its own folder without checking them) and bundled it with their own DLLs in an AllMyBasic.msi package distributed outside official channels. Siemens attributes the activity to the Romulus multi-platform ClickFix campaign, where victims are tricked into pasting a command into the Run box or PowerShell. Siemens says no Siemens system, product or update channel was breached and the program itself was not modified. Update (Oct 20): CISA added CVE-2026-110936 to KEV on Oct 20, federal due date Nov 3.

Do now: make sure Siemens Software Center is at 4.0.9.8 or later, block 96.62.218[.]59, wizardexpensive[.]com and 2.27.248[.]127, and hunt for the signed binary running from user profile folders (see the hunt item).