CVE-2026-110936

Exploited in the wild. In CISA KEV since 2026‑10‑20. Fixed in V4.0.9.8.

CVSS 3.16.7Medium EPSS percentile14th0.2% chance in 30 days CISA KEVListedsince 2026-10-20, due 2026-11-03
No public exploit known FixV4.0.9.8Upgrade to this build

Published 2026-10-15Updated 2026-10-21Sources: CVE.org, NVD, CSAF

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Siemens Software CenterAffected: < V4.0.9.8Upgrade to: V4.0.9.8Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your organization has Siemens Software Center installed and note its version.
If the version is older than V4.0.9.8, treat it as vulnerable.
Download and install Siemens Software Center V4.0.9.8 or later from Siemens' official source.
Make sure no unauthorized files exist alongside the application's installation folder before and after updating.
Warn staff not to run installers or files from untrusted sources, since this attack relies on tricking users via fake prompts (ClickFix-style campaigns).

Usually a quick update

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

Coverage timeline

3 publishers

Advisory coverage
as reported · Oct 21, 2026·The Hacker News summary
Siemens confirmed active exploitation of CVE-2026-110936, a DLL side-loading flaw in Siemens Software Center, used by the Romulus ClickFix campaign to deploy malware.
as reported · Oct 20, 2026·Help Net Security summary
Added to CISA KEV catalog
Oct 20, 2026·CISA KEV

Sourced from public security reporting — each date is when it was published, not when it happened. 1 further article named this CVE in wider roundups without reporting it as a distinct event.

What it is

From the CVE record

A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.

In plain language

Written by AI from the record

Attackers are already exploiting this flaw in Siemens Software Center by planting a fake file next to it to run malicious code, so you should update it now if you use it.

Siemens Software Center before V4.0.9.8 loads DLLs from an uncontrolled search path (CWE-427), letting an attacker who already has local access plant a malicious library that executes with the application's privileges — confirmed exploited in the wild via the Romulus ClickFix campaign.

If you're affected

Full system compromise
Malware/ransomware installation
Operational disruption
Loss of trust in signed software

What is it

Siemens Software Center is a tool used to manage and install Siemens software on a computer. This bug is like leaving a spare key under the doormat: the program looks for certain helper files in a shared location, and an attacker who already has some access to the machine can drop a fake helper file there that the program runs instead, giving the attacker control.

Who is affected

This matters to you if you or your IT team use Siemens Software Center to manage Siemens applications on any computer. The attack requires the attacker to already have some level of access to the machine (not a random internet attacker), but real-world attackers have been getting that access through separate malware/scam campaigns, so this risk is active, not theoretical.

How urgent is it

Attackers are already exploiting this flaw in a real campaign, abusing a genuine, signed copy of Siemens Software Center to run malicious code on infected machines. This is not a theoretical risk — act now rather than waiting for a routine patch cycle.

What to do — in detail

Confirm exposure by checking installed version of Siemens Software Center on all endpoints; any version below V4.0.9.8 is vulnerable.
Upgrade to the fixed version, V4.0.9.8, through Siemens' official distribution channel; no breaking changes have been reported for this update.
As a temporary workaround if immediate patching isn't possible, restrict write permissions on the application's installation and working directories to prevent unauthorized DLL placement, and ensure the application is not run from or alongside untrusted/writable paths.
Monitor endpoints for indicators of the Romulus/ClickFix campaign (unexpected DLLs or executables placed alongside Siemens Software Center binaries, unusual process launches from the install directory).
This CVE is not currently in the CISA KEV catalog, so there is no federal remediation deadline, but given confirmed active exploitation, prioritize patching on the same timeline as a KEV-listed flaw.

Technical context

CVSS 3.1 score 6.7 (Medium), vector AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H — local attack vector requiring high-privilege authentication but no user interaction, with high impact to confidentiality, integrity, and availability. Weakness is CWE-427 (Uncontrolled Search Path Element), enabling DLL hijacking/planting. EPSS predicts low likelihood (3rd percentile) but this is superseded by confirmed exploitation reported by news sources (Huntress Labs attribution, Romulus ClickFix campaign) — no public exploit code is on record, and the CVE is not yet listed in CISA KEV, but active in-the-wild abuse has been reported, making exploit maturity effectively 'active' despite low EPSS and no PoC.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS14th

CISA KEV

Listed as exploited in the wild since 2026-10-20.

US federal agencies must remediate by 2026-11-03.

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.2% chance of exploitation activity in the next 30 days, which ranks it in the 14th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Sustained, driven by in-the-wild reports.

Lifecycle

12 events over 6 days, from the signal feeds we watch.

2026-10-21Patch availablerecord updated, record updated
2026-10-20Added to CISA KEVrecord updated
2026-10-17Record updated
2026-10-15Publishedweakness classified, att&ck mapped, record updated, record updated, record updated

Affected products

Siemenscommercial · DEaka siemens ag
- Siemens Software CenterICS / OT / IoT
- software centerICS / OT / IoT

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Scored 6.7 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required HighRequires admin or elevated privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable