Siemens says attackers distributed a genuine, signed copy of Siemens Software Center 3.5.8.7 alongside malicious helper files. When started, the vulnerable program loaded the attackers’ DLLs, libraries containing executable code, with its own privileges.

The October 19 ProductCERT report attributes the activity to the Romulus ClickFix campaign. ClickFix tricks people into running commands under the guise of verification or troubleshooting.

Exploitation status: active exploitation validated by Siemens and listed in CISA’s exploited-vulnerability catalog. Siemens says it knows of no breach of its systems, products or update channel. The signed executable was unmodified; the malicious files were distributed beside it outside official channels.

Two different exposure paths

The SSA-580366 advisory identifies CVE-2026-110936, an uncontrolled library search path. It lists all versions before 4.0.9.8 as affected and 4.0.9.8 or later as the remediation.

The advisory describes an authenticated local attacker placing a library in a searched directory. The campaign instead delivers its own vulnerable executable and neighboring files together. A PC can therefore be affected even if its owner never installed Siemens software legitimately.

A valid signature authenticates the Siemens executable. It does not establish the safety of everything that executable loads.

Patch legitimate copies; investigate unexpected ones

  • Update legitimate Software Center installations to 4.0.9.8 or later. Siemens says existing installations update on their next startup. Confirm the resulting version rather than assuming a dormant installation has updated.
  • Download only from official Siemens sources. Avoid third-party bundles and commands presented as human-verification steps.
  • Investigate unexpected Software Center startup entries or scheduled tasks. Siemens flags this especially on PCs where nobody installed the application.
  • Review endpoint records for unusual execution paths. Its report names SiemensSoftwareCenter.exe under AppData\Local\Programs, launched by msiexec, and an unexpected SM Software Provisioning Service folder.
  • Use the primary report’s indicators to review historical activity. They include campaign network addresses and malicious-file hashes. Siemens recommends behavioral and folder-based detection because the carrier executable itself is genuine.

For signs of compromise, Siemens recommends isolating the PC and following incident response procedures. Updating an unrelated legitimate installation does not remove the malicious bundle, its startup entries or credentials already stolen.

Keep the dates separate

The advisory was first published October 15, added remediation in its October 17 revision, and linked the campaign report on October 19. The campaign report describes 4.0.9.8 as the fix.

CISA’s Known Exploited Vulnerabilities catalog added the CVE on October 20. That is a catalog-addition date, not the first attack date. Its November 3 due date applies to the relevant federal remediation requirements, not a safe waiting period for other users.

Siemens is the affected software vendor and the source of the campaign findings. The reviewed material gives no victim count or independently verified campaign-wide prevalence.

Caveat: the published indicators describe observed activity; their absence cannot establish that a suspicious endpoint is clean.