Hackers Exploit Siemens Software Center Vulnerability to Execute Malicious Code

Siemens has confirmed that the CVE-2026-110936 vulnerability, a DLL side-loading flaw in Siemens Software Center, is being actively exploited.

Attackers are using this vulnerability to execute malicious code through a legitimate, digitally signed application. Siemens published advisory SSA-580366 on October 15 and has addressed the issue in version 4.0.9.8.

According to the campaign report, attackers distributed an unmodified Siemens executable alongside malicious DLL files outside official channels. Siemens stated that it is not aware of any breaches affecting its systems, products, or update infrastructure.

Siemens Software Center Vulnerability

This vulnerability arises from an uncontrolled DLL search path, classified as CWE-427. An attacker can place a crafted library in a directory that the application searches, enabling them to execute code with the application’s privileges. Siemens has assigned CVSS scores of 6.7 under version 3.1 and 8.4 under version 4.0 to this issue.

In the observed campaign, attackers used Siemens Software Center version 3.5.8.7 as their delivery method. The application loaded attacker-supplied helper libraries from its own directory without verifying them, allowing malicious code to run when the legitimate executable was launched.

The Siemens binary maintained its valid signature, but the malicious functionality was embedded in adjacent DLLs. Checking only the executable’s authenticity would overlook these harmful components.

The report attributes this activity to the Romulus multi-platform ClickFix campaign. It emphasizes the importance of not pasting commands from websites into Windows Run or PowerShell, highlighting the campaign’s social engineering aspect.

The reported infrastructure includes active payload-hosting and command-and-control endpoints: 96.62.218[.]59 and wizardexpensive[.]com.

An inactive distribution endpoint, 2.27.248[.]127, previously hosted the malicious AllMyBasic.msi bundle. These statuses reflect the supplied report and have not been independently verified for current availability.

Defenders should investigate the following potential indicators:

• Unexpected Siemens Software Center startup entries or scheduled tasks.
• SiemensSoftwareCenter.exe executing from AppData\Local\Programs, especially when initiated by msiexec.
• An SM Software Provisioning Service directory located beneath that folder.
• Files named activate.bak or statinfosta.DB next to the executable.
• An FTSuite directory containing ftc.uml under AppData\Local.
• The report also identifies `archive.dll` as a malicious file. Detection efforts should focus on suspicious directories, adjacent libraries, process ancestry, persistence mechanisms, and network activity, rather than solely relying on the genuine Siemens executable’s signature.

All Siemens Software Center versions earlier than 4.0.9.8 are affected. Existing installations will automatically update during their next startup; administrators should verify that the corrected version is installed.

Organizations should block the reported infrastructure and review historical connections, including traffic to the inactive distribution address. If you detect any signs of compromise, isolate affected endpoints, terminate malicious processes, investigate persistence, and follow established incident response protocols.

Always download replacement installers only from official Siemens sources. While updating resolves the vulnerability, it should not replace a thorough investigation of systems that may already show indicators of compromise.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.