Siemens Software Center Flaw CVE-2026-110936 Exploited in Wild

Executive Summary

Siemens has issued a warning that a high-severity vulnerability, CVE-2026-110936, in its Siemens Software Center (SSC) is being actively exploited in the wild. The vulnerability is a DLL side-loading flaw with a CVSS v4.0 score of 8.4. Attackers associated with the "ClickFix" malware campaign are exploiting it by tricking users into running a malicious installer. This installer contains a legitimate, signed, but vulnerable version of the SSC client alongside a malicious DLL. When the legitimate application runs, it improperly loads the malicious DLL, leading to arbitrary code execution. Siemens has released version 4.0.9.8 to fix the issue and states that automatic updates should protect most users.

Vulnerability Details

• CVE ID: CVE-2026-110936
• CVSS v4.0 Score: 8.4 (High)
• Vulnerability Type: Uncontrolled Search Path Element (CWE-427), commonly known as DLL Side-Loading.
• Attack Vector: Local
• Privileges Required: Low (Requires an authenticated user to execute the malicious package)
• User Interaction: Required

The vulnerability exists because older versions of the Siemens Software Center client search for required DLLs in the same directory as the executable before searching in trusted system directories. An attacker can create a malicious installer package (e.g., AllMyBasic.msi) that places both a legitimate, signed Siemens.Software.Center.exe and a malicious DLL (e.g., a fake version.dll) in the same folder. When the user runs the executable, it loads the malicious DLL, granting the attacker code execution with the same privileges as the SSC client.

Affected Systems

• Product: Siemens Software Center (SSC)
• Affected Versions: All versions prior to 4.0.9.8

Siemens has clarified that the vulnerability is in the client application and not in their backend systems or product update channels. The attack relies on distributing a malicious package containing a vulnerable version of the software.

Exploitation Status

Siemens confirmed on October 19, 2026, that CVE-2026-110936 is being actively exploited. The attacks are attributed to the "ClickFix" malware campaign. This campaign uses social engineering to convince users to run malicious commands or installers, often bypassing traditional download scanners. The attackers bundle a legitimate but vulnerable version of SSC (specifically version 3.5.8.7 has been observed) into their malicious installers. Because the main executable is signed by Siemens, it may evade some security checks, making the attack more effective.

Impact Assessment

Successful exploitation allows an attacker to execute arbitrary code on the victim's machine with the permissions of the logged-in user running the SSC client. This can lead to the deployment of further malware, such as remote access trojans (RATs), spyware, or ransomware. The primary impact is a loss of confidentiality, integrity, and availability of the compromised system. Since the attack requires user interaction, the scale of impact depends on the success of the social engineering campaign. However, for organizations that use Siemens software extensively, a successful compromise could provide a foothold for attackers to move laterally within the network.

Cyber Observables — Hunting Hints

The following patterns may help identify vulnerable or compromised systems:

Detection Methods

1. Vulnerability Scanning: Use vulnerability scanners to detect outdated and vulnerable versions of the Siemens Software Center on endpoints. D3FEND: D3-SA: Software Analysis (conceptual overlap).
2. EDR Monitoring: Configure EDR solutions to detect DLL side-loading attempts. Create rules to alert when a process loads a DLL from an unusual location, such as its own directory when a system version exists. D3FEND: D3-PA: Process Analysis.
3. File Integrity Monitoring: Monitor for the presence of known malicious installers like AllMyBasic.msi or unexpected versions of Siemens.Software.Center.exe appearing on systems.
4. Threat Hunting: Hunt for systems running SSC versions older than 4.0.9.8. Search file systems and download caches for suspicious MSI or ZIP files containing the SSC executable.

Remediation Steps

1. Update Immediately: The primary remediation is to update the Siemens Software Center to version 4.0.9.8 or later. Siemens notes that the application is designed to update automatically, but administrators should verify that the update has been applied across all endpoints. D3FEND Hardening: D3-SU: Software Update.
2. Remove Old Versions: If manual installation is required, ensure that any older, vulnerable versions of SSC are completely uninstalled before installing the new version.
3. Application Control: Implement application control policies, such as Windows Defender Application Control (WDAC), to restrict the execution of unauthorized applications and DLLs. This can prevent the malicious DLL from being loaded even if the vulnerable executable is present. D3FEND Hardening: D3-EAL: Executable Allowlisting.
4. User Education: Since the attack relies on social engineering, reinforce user training on the dangers of downloading and running software from untrusted sources.