---
title: Siemens confirms active exploitation of Siemens Software Center DLL side-loading flaw CVE-2026-110936; update to 4.0.9.8 | ctxsec
url: https://ctxsec.com/items/siemens-software-center-cve-2026-110936-exploited
description: ""
status: "confirmed (vendor); on CISA KEV Oct 20 (due Nov 3), last updated Oct 20, 2026, 3:55 PM ET"
published: 2026-10-19
updated: 2026-10-20T15:55:00-04:00
---

> 

[← Cybersecurity News](/news) · [markdown](/items/siemens-software-center-cve-2026-110936-exploited.md)

confirmed (vendor); on CISA KEV Oct 20 (due Nov 3)

2026-10-19 · updated

Oct 20, 2026, 3:55 PM ET

### Siemens confirms active exploitation of Siemens Software Center DLL side-loading flaw CVE-2026-110936; update to 4.0.9.8

Siemens ProductCERT said on Oct 19 that it has validated active exploitation of CVE-2026-110936 (CVSS 3.1 6.7), a DLL side-loading weakness in Siemens Software Center, its Windows app for installing Siemens software. Advisory SSA-580366 (published Oct 15, updated Oct 19) covers all versions before 4.0.9.8; existing installs update automatically on next start. Attackers took a genuine, validly signed copy of Siemens Software Center (version 3.5.8.7, which loaded helper DLLs from its own folder without checking them) and bundled it with their own DLLs in an `AllMyBasic.msi` package distributed outside official channels. Siemens attributes the activity to the Romulus multi-platform ClickFix campaign, where victims are tricked into pasting a command into the Run box or PowerShell. Siemens says no Siemens system, product or update channel was breached and the program itself was not modified. **Update (Oct 20):** CISA [added](https://www.cisa.gov/news-events/alerts/2026/10/20/cisa-adds-six-known-exploited-vulnerabilities-catalog) CVE-2026-110936 to KEV on Oct 20, federal due date Nov 3.

**Do now:** make sure Siemens Software Center is at 4.0.9.8 or later, block `96.62.218[.]59`, `wizardexpensive[.]com` and `2.27.248[.]127`, and hunt for the signed binary running from user profile folders (see the hunt item).

Sources: [Siemens ProductCERT blog (Oct 19)](https://productcert.siemens.com/news/2026/10/19/active-exploitation-of-cve-2026-110936-in-siemens-software-center/) · [Siemens SSA-580366](https://cert-portal.siemens.com/productcert/html/ssa-580366.html) · [CISA adds six KEVs (Oct 20)](https://www.cisa.gov/news-events/alerts/2026/10/20/cisa-adds-six-known-exploited-vulnerabilities-catalog)