Siemens Software Center Is on KEV Because Attackers Sideloaded Past the Signature

a genuine, signed Siemens Software Center binary. a couple of attacker DLLs sitting next to it. version 3.5.8.7 politely LoadLibrarys whatever is in its own folder. CVE-2026-110936. CWE-427. CISA KEV on October 20. CISA ICS advisory republished October 22. Siemens ProductCERT says the Romulus ClickFix crew is already using it. your allowlist that trusts “signed Siemens” just became an unpaid malware loader.

what landed

Siemens ProductCERT advisory SSA-580366 and CISA ICSA-26-295-03 describe the same boring, lethal pattern:

• CVE-2026-110936: uncontrolled search path element in Siemens Software Center. the app loads DLLs from a directory it searches without locking that search down.
• affected: Siemens Software Center all versions before V4.0.9.8. Siemens named 3.5.8.7 as the build abused in the wild at the time of the campaign write-up.
• CVSS: 6.7 (v3.1, AV:L/AC:L/PR:H/UI:N) and 8.4 (v4.0). local, authenticated-looking on paper. in practice the campaign ships the signed host plus the DLLs as a bundle, so the “local attacker” is whoever just ran the MSI.
• fix: update to V4.0.9.8 or later. existing installs auto-update on next startup. or download from the official Siemens Software Center page.
• KEV: added October 20, 2026. federal due date tracked around November 3, 2026. ICSA republication October 22, 2026.

step 1: stop trusting the brand, check the version

# on Windows lab / EDR inventory
Get-ItemProperty 'HKLM:\Software\Siemens\...'  # or your CMDB equivalent
# or just ask the binary
(Get-Item 'C:\Program Files\Siemens\Software Center\SiemensSoftwareCenter.exe').VersionInfo

anything below 4.0.9.8 is in scope. Siemens says existing versions auto-update when the app starts. that is helpful if the app is allowed to start. it is useless if the only copy on the box is the attacker-planted one under AppData that never talks to the real update channel.

step 2: how the abuse actually worked

Siemens ProductCERT is unusually blunt. attackers used a genuine copy of Siemens Software Center with a valid signature and placed their own files next to it. they picked the program because:

• it is signed and trusted by naive allowlists
• vulnerable builds loaded helper files from their own folder without verifying them
• the Siemens binary itself was never modified, so hash-based “Siemens is fine” checks fail open

attribution from Siemens: Romulus multi-platform ClickFix campaign. ClickFix, for the uninitiated, is the “press Win+R and paste this verification command” social-engineering bit. Siemens explicitly warns: a real “I am not a robot” check never asks you to paste into Win+R, the Run box, or PowerShell.

step 3: IOCs that are not vibes

from the Siemens ProductCERT active-exploitation post (defanged here the way they published them; put the real dots back in your blocklists):

• 96.62.218[.]59 (active) payload hosting / C2
• wizardexpensive[.]com (active) payload hosting / C2
• 2.27.248[.]127 (inactive) distribution of AllMyBasic.msi
• AllMyBasic.msi SHA-256: f4d7c5321bb0d1bda439304a753bcf9b467b98ca53c7e9493b9c2c3451092e4a
• archive.dll SHA-256: 3fdcc7d7d049a89711fb31fb236940a1c5a09d899143ffd20c3c41fb1f2cf491

Siemens notes the inactive distribution channel no longer serves files, but systems that downloaded earlier may still be infected. “the MSI host is dead” is not a clean bill of health.

step 4: what to hunt tonight

Siemens ProductCERT warning signs, translated into tickets:

• “Siemens Software Center” in Startup or Task Scheduler on a PC that never had Siemens software
• folder SM Software Provisioning Service under AppData\Local\Programs
• files named activate.bak or statinfosta.DB next to SiemensSoftwareCenter.exe
• folder FTSuite containing ftc.uml under AppData\Local
• SiemensSoftwareCenter.exe running from AppData\Local\Programs, parented by msiexec
• network connections to the IPs / domain above

detection guidance they hammer: detect on folder and behaviour, not on the Siemens file fingerprint. the file itself is genuine. if your EDR allowlists signed Siemens and goes back to sleep, you bought the campaign a hall pass.

why defenders care

• signature theater: Authenticode on the host binary does not imply the DLLs beside it are trustworthy.
• industrial adjacency: CISA lists critical manufacturing, transportation, energy, healthcare, finance, and government as sectors where SSC shows up. this is not only a CAD-desk problem.
• ClickFix delivery: users paste the installer into existence. your phishing click-rate metrics will not see it.
• update path assumptions: “it auto-updates on next start” fails when the copy that runs is the attacker bundle under AppData.
• KEV clock: federal friends have a due date. everyone else gets the same attackers without the BOD letterhead.

controls that are not theater

1. update Siemens Software Center to V4.0.9.8 or later everywhere you actually installed it from Siemens.
2. block 96.62.218.59, wizardexpensive.com, and 2.27.248.127 at DNS, proxy, and firewall. hunt historical hits on the inactive host too.
3. hash-block the MSI and archive.dll SHA-256 values above in your EDR / content filter.
4. alert: SiemensSoftwareCenter.exe outside Program Files, especially under AppData, especially parented by msiexec.
5. alert: unexpected DLLs next to SSC executables outside the default install folder.
6. user education that is not a poster: never paste Win+R / PowerShell “verification” commands from a web page.
7. if you find the artifacts: isolate, stop the process, remove startup/task entries, rotate credentials, then do IR properly.

timeline that matters

• 2026-10-15: Siemens ProductCERT publishes SSA-580366. CISA ICSA conversion starts its revision history the same day.
• 2026-10-17: advisory revision adds remediation clarity for SSC.
• 2026-10-19: Siemens posts active exploitation details, IOCs, Romulus ClickFix attribution. advisory revision points at the blog.
• 2026-10-20: CISA adds CVE-2026-110936 (plus Plex chain and SiteGuard) to KEV.
• 2026-10-22: CISA republishes the ICS advisory (ICSA-26-295-03 revision 4). NHS England Digital publishes CC-4874.

if your vulnerability program still sorts by CVSS and saw “6.7 local” on October 15, then ignored KEV on October 20, you optimized for the wrong spreadsheet.

ClickFix is the delivery, not the bug

Siemens spends unusual ink telling civilians not to paste web-page commands into Win+R. that is because the bug alone is a local loader problem. the campaign is a social-engineering-to-signed-binary pipeline. users are convinced they are solving a captcha or fixing a driver. msiexec parents a “Siemens” process under AppData. your phishing KPIs never blink because nobody clicked a macro.

train the behavior: real verification flows do not require the Run dialog. security awareness that only covers email attachments is cosplay.

industrial desk reality

CISA’s sector list for this advisory is the usual ICS greatest hits: critical manufacturing, transportation, energy, healthcare, finance, government. SSC is how a lot of those desks pull Siemens tooling. the attackers did not need a PLC protocol. they needed a signed updater-shaped binary that engineers already trust. OT/IT convergence debates can continue on LinkedIn. the MSI already landed.

sloth take

we taught endpoint teams to trust signatures and taught users to paste whatever the captcha told them into Win+R. attackers brought a real Siemens binary to the party and let Windows do the loading. patch to 4.0.9.8. block the IOCs. hunt AppData. and maybe stop treating “signed by a vendor we recognize” as a personality.

Need a boring hunt across industrial desktops for signed-binary sideload patterns before the next ClickFix wave? Book a slot with Dark Edge Consulting.

sources

• CISA KEV addition October 20, 2026 (CVE-2026-110936 among six adds)
• CISA ICSA-26-295-03: Siemens Software Center (republication October 22, 2026)
• Siemens ProductCERT SSA-580366 and active-exploitation post (2026-10-19), including IOCs and Romulus ClickFix attribution
• NHS England Digital cyber alert CC-4874 on CVE-2026-110936