Siemens Software Center DLL sideloading flaw CVE-2026-110936 exploited in ClickFix attacks: signed SiemensSoftwareCenter.exe used to load a malicious archive.dll and drop a RAT; fixed in 4.0.9.8

Siemens ProductCERT said on 19 October 2026 that it has confirmed active exploitation of CVE-2026-110936, a DLL sideloading flaw in Siemens Software Center (the installer and update manager for Siemens software) that it fixed in version 4.0.9.8 and disclosed in advisory SSA-580366 on 15 October. The app loaded helper DLLs from its own folder without checking them, so attackers shipped a genuine, validly signed copy of version 3.5.8.7 alongside their own archive.dll inside an installer called AllMyBasic.msi; msiexec.exe installs it under AppData\Local\Programs and starts SiemensSoftwareCenter.exe, which loads the attacker DLL. Siemens says the Siemens program itself was not modified and no Siemens system, product or update channel was breached, and it is sharing indicators with EDR vendors and authorities. The victims are lured by ClickFix pages that get them to paste a PowerShell command; Huntress found the bug and The Hacker News ties the campaign to the ROMULUS ClickFix delivery platform (separate card on this desk), with some lures reached through malicious ChatGPT Custom GPTs. The payload is a remote access trojan. Siemens rates the flaw CVSS 3.1 6.7 and CVSS 4.0 8.4 because it needs local access, but in this campaign the attackers bring the vulnerable signed copy with them, so PCs that never had Siemens software are also at risk. Canada's Cyber Centre issued AV26-1063. Primary: Siemens ProductCERT.

Product

Siemens Software Center (Windows)

Versions

All versions before 4.0.9.8 affected; the campaign uses a signed copy of 3.5.8.7. Fixed: 4.0.9.8 (existing installs update automatically on next start).

CVSS

6.7 (CVSS 3.1) / 8.4 (CVSS 4.0), Siemens

Exploited in Australia?

unknown

Patch to

Start Siemens Software Center so it updates to 4.0.9.8 or later, and download Siemens software only from official Siemens sources. Block 96.62.218[.]59, wizardexpensive[.]com and 2.27.248[.]127. Hunt for SiemensSoftwareCenter.exe running from AppData\Local\Programs or started by msiexec.exe, an 'SM Software Provisioning Service' folder, activate.bak or statinfosta.DB beside the exe, or AppData\Local\FTSuite\ftc.uml, and detect on path and behaviour rather than the file hash (the exe is genuine). If found, isolate the PC, stop the process, remove the start-up entry and scheduled task, and reset the user's passwords.

Primary: Siemens ProductCERT — Active exploitation of CVE-2026-110936 in Siemens Software Center (19 Oct 2026) · Vendor: Siemens SSA-580366 — DLL sideloading vulnerability in Siemens Software Center (15 Oct 2026, V1.2 19 Oct) · CVE: CVE-2026-110936 · The Hacker News — ClickFix attackers exploit Siemens Software Center flaw to deploy RAT (20 Oct 2026)

vulnerabilities