lee1981 (@lee1981b) on X

What it is

CVE-2026-110936 is an uncontrolled search path flaw (CWE-427) in Siemens Software Center, the Siemens download/install/activation application. It is not Microsoft Software Center. All versions below V4.0.9.8 are affected, and Siemens advisory SSA-580366 (HTML V1.2, updated 19 October 2026) names V4.0.9.8 or later as the fix. Siemens confirms active exploitation, and CISA added the CVE to KEV on 20 October 2026. Siemens credits Jose Oregon of Huntress Labs.

How it works

Attackers reuse a genuine, signed, unmodified Software Center executable as a carrier and place malicious DLLs beside it. The application loads a DLL from the uncontrolled location, so the supplied code runs with the application's privileges. The carrier's valid signature says nothing about the neighbouring DLLs or the package that delivered them. Siemens ties this to a campaign it labels Romulus, a multi-platform ClickFix operation. Distribution happened outside official channels, and Siemens says it knows of no breach of its own systems or update channel.

Preconditions / Affected

• Siemens CNA scores: CVSS v4.0 8.4 High (CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) and v3.1 6.7 Medium (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
• The published model is an authenticated local attacker with high privileges and no user interaction. The ClickFix social engineering belongs to the campaign, not to the CVSS conditions.
• The primary record does not establish SYSTEM execution or any installation's exact search order.
• NVD is still "Undergoing Analysis". Its displayed metrics are the Secondary ones from Siemens.
• CISA SSVC (20 October): exploitation active, automatable no, technical impact total. FIRST EPSS (20 October): 0.135%, 2.673rd percentile.

What to do

1. Update legitimate installs to V4.0.9.8 or later through Siemens' official route, then verify the active build and path on each endpoint. Siemens says the app updates at next startup, which does not prove the old executable stopped running.
2. Hunt for copied carriers outside the managed inventory. The campaign example was build 3.5.8.7, but the whole range below V4.0.9.8 is affected. Siemens highlights SiemensSoftwareCenter.exe under AppData\Local\Programs with msiexec ancestry.
3. Do not launch a suspicious copy to trigger its updater. Preserve the files and timeline first.
4. Search retained DNS, proxy, flow and EDR data for the Siemens indicators below. Do not browse to them.
5. If compromise is supported, Siemens advises isolating the host and stopping the malicious process before removing startup or task persistence, plus password resets.

Siemens-published indicators (19 October 2026):

96.62.218[.]59        payload hosting / C2, Active at publication
wizardexpensive[.]com payload hosting / C2, Active at publication
2.27.248[.]127        distributed AllMyBasic.msi, Inactive at publication (search historically)
AllMyBasic.msi  SHA-256 f4d7c5321bb0d1bda439304a753bcf9b467b98ca53c7e9493b9c2c3451092e4a
archive.dll     SHA-256 3fdcc7d7d049a89711fb31fb236940a1c5a09d899143ffd20c3c41fb1f2cf491

File and persistence leads, which may collide with legitimate names:

• SM Software Provisioning Service under AppData\Local\Programs.
• activate.bak or statinfosta.DB beside SiemensSoftwareCenter.exe.
• FTSuite containing ftc.uml under AppData\Local.
• An unexpected Software Center startup app or task.

For telemetry, the page lists Sysmon event 1 (process), 7 (image load), 11 (file creation), 3 (network) and 22 (DNS). Events 7 and 3 are off by default, and Security 4688 needs process auditing. Without event 7, a process start alone does not show a DLL loaded.

Caveats

• The CISA KEV due date is 3 November 2026 and references BOD 26-04. It applies to covered FCEB assets, not to every reader. The entry's forensicTriage field says No, which is not a clean-host finding. Known ransomware use is Unknown.
• The indicators are not an exhaustive signature set. A changed payload will have a different hash, and Siemens' attribution to Romulus is not independently verified.
• The author did no reproduction and did not contact the infrastructure. The hash and event-log methods were checked against documentation only.
• Patching does not remove malicious files or undo earlier access. A blocked connection does not exclude earlier execution.
• Dates are disclosure and assessment dates, not a first-attack date.