CVE-2026-110936CampaignPublished 10/20/2026

Active Exploitation of CVE-2026-110936 in Siemens Software Center

Affects Siemens Software CenterSource AlienVault OTX General

Severity

Unrated

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 10/20/2026
KEV deadline: 11/03/2026
EPSS: 0.2% chance of exploitation in 30 days – higher than 14% of CVEs

What to do

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Affected software

Product	Affected	Fixed in
Siemens Software Center	Affected =3.5.8.7	Fixed in–

Description

A DLL side-loading vulnerability (CVE-2026-110936) in Siemens Software Center version 3.5.8.7 is actively exploited by attackers distributing a genuine signed application with malicious DLLs via unofficial channels. The vulnerable software loads attacker-supplied DLLs without validation, enabling code execution. The attack uses ClickFix social engineering to trick users into running commands. Version 4.0.9.8 patches the vulnerability with automatic updates applied on restart. No official Siemens systems or distribution channels were compromised during this campaign.

Summary

CVE-2026-110936 is a DLL side-loading vulnerability in Siemens Software Center version 3.5.8.7. Attackers distribute a legitimate, digitally signed copy of the application alongside malicious DLL files through unofficial channels. When executed, the vulnerable version loads these attacker-supplied DLLs without validation, allowing arbitrary code execution. The attack vector involves social engineering tactics known as ClickFix to trick users into executing commands. The campaign uses dedicated infrastructure for payload hosting and command-and-control. Siemens released version 4.0.9.8 which patches this vulnerability, with automatic updates applied upon application restart. No official Siemens systems or distribution channels were compromised during this campaign.

Impact

Successful exploitation allows attackers to execute arbitrary code on systems running the vulnerable Siemens Software Center version 3.5.8.7 by loading malicious DLLs. This can lead to unauthorized control of affected systems. The campaign leverages social engineering to trick users into executing malicious commands. However, no official Siemens systems or distribution channels were compromised, limiting the scope of the attack to users who obtained the software from unofficial sources.

Defensive guidance

Upgrade Siemens Software Center to version 4.0.9.8 or later, which patches the DLL side-loading vulnerability. The update is applied automatically when the application restarts. Avoid obtaining the software from unofficial or untrusted sources to prevent exposure to malicious DLLs. No additional action is required if the software is already updated to the fixed version.

Weaknesses

CWE-427Unclassified weakness (opens in a new tab)

Indicators of compromise

Domains 1

wizardexpensive.com

IP addresses 2

96.62.218.59
2.27.248.127

CVEs 1

CVE-2026-110936

Hashes 2

3fdcc7d7d049a89711fb31fb236940a1c5a09d899143ffd20c3c41fb1f2cf491
f4d7c5321bb0d1bda439304a753bcf9b467b98ca53c7e9493b9c2c3451092e4a