Siemens Software Center Flaw CVE-2026-110936 Is Exploited Through a Signed Copy of Its Own App

Siemens Software Center 3.5.8.7 loads helper files from its own folder without checking them, and attackers are using that to run code through a genuine, validly signed copy of the program. CISA added the flaw, CVE-2026-110936, to its Known Exploited Vulnerabilities catalog on Oct. 20 with a federal deadline of Nov. 3. Version 4.0.9.8 fixes it.

The bug is DLL side-loading, which means a program picks up a malicious library placed next to it instead of the one it meant to load. Siemens rates it 8.4 on CVSS v4.0, according to Help Net Security. Huntress Labs researcher Jose Oregon reported it.

How the attack runs

The score overstates the risk for a machine nobody tricks and understates it for one where a user is persuaded to run an installer. Exploitation here is not a remote attack on a listening service. The victim runs a carrier installer, AllMyBasic.msi, which was distributed outside Siemens' official channels, and the installer lays down a signed Software Center beside attacker-chosen files.

Siemens described the method in its own words, as quoted by Help Net Security: "The attackers used a genuine copy of Siemens Software Center with a valid signature and placed their own files next to it." The company also said "No Siemens system, product or update channel was breached to our knowledge."

A valid signature therefore tells a defender nothing about this binary. Help Net Security listed one hunting rule: look for SiemensSoftwareCenter.exe launched by msiexec from AppData\Local\Programs.

Romulus, the delivery panel behind it

Siemens attributes the activity to Romulus, which Forescout's Vedere Labs found while investigating an incident. Forescout describes it as a multi-payload ClickFix delivery platform. ClickFix tricks a user into pasting a command into Win+R, the Run box or PowerShell.

Forescout identified six IP addresses running the panel. It serves a PowerShell staging script and a trojanized MSI carrying a loader. One payload, LegionLoader, can collect sensitive information from Chrome. Forescout said "ROMULUS is a reusable delivery backend rather than a single hard-coded malware server," and that the operator is unknown. BleepingComputer, which covered the CISA additions, quoted Forescout saying Romulus "may be a privately operated panel, a commercial cybercriminal delivery service".

Timeline of advisory and fix

Date	Event
Oct. 15	Siemens publishes advisory SSA-580366
Oct. 17	Advisory updated: 4.0.9.8 resolves the flaw
Oct. 19	Siemens blog post warns of active exploitation
Oct. 20	CISA lists CVE-2026-110936; Help Net Security reports
Nov. 3	CISA deadline for federal agencies

The catalog entry is titled "Siemens Software Center Uncontrolled Search Path Element Vulnerability" and lists ransomware use as unknown. The fix and the exploitation warning were two days apart, so anyone patching from the advisory alone would have been updating before the warning.

What to do

Update to 4.0.9.8. Siemens said existing installations update automatically on the next launch, per Help Net Security. Anyone who installed Software Center from a file that did not come from Siemens should treat the machine as suspect: isolate it, stop the process, remove startup entries and reset passwords, because LegionLoader targets browser data.

Siemens also told users to block the infrastructure listed in its blog post and never to paste commands from web pages into the Run box. The CISA deadline of Nov. 3 covers federal agencies only; the exploitation window for everyone else opened on Oct. 19.

The same catalog carried AhsayCBS and FortiMail flaws; both stories cover enterprise products with exploitation on record.