CVE-2026-110936Vulnerability
Siemens Software Center Uncontrolled Search Path Element Vulnerability
Reported by 6 independent sources · first reported by SecurityWeek · last reported
Last reported 2 days ago
Fix due 3 Nov 2026
Used by ransomware: not knownCISA KEV catalogue
higher than 14% of CVEsFIRST EPSS, as of 23 Oct 2026
What the reports say
8 reports, newest first · the exact sentence from each-
Siemens Software Center“Siemens Software Center vers:intdot/<4.0.9.8 (CVE-2026-110936)”
-
CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws“One of them is a DLL sideloading vulnerability in Siemens Software Center (CVE-2026-110936, CVSS score: 8.4) that has been abused in ClickFix attacks using a platform called Romulus.”
-
Attackers exploit Siemens Software Center flaw in active ClickFix malware campaign“Siemens has confirmed the active exploitation of CVE-2026-110936, a DLL side-loading vulnerability in Siemens Software Center, the company’s tool for downloading, installing and managing its software.”
-
CISA Adds Six Known Exploited Vulnerabilities to Catalog“CVE-2026-110936 Siemens Software Center Uncontrolled Search Path Element Vulnerability”
-
Siemens Customers Targeted by ClickFix Attackers Exploiting DLL Side-Loading Flaw“The Siemens blog, published on October 19, detailed how attackers are targeting CVE-2026-110936 (CVSS 8.4) to load malicious DLL files into a directory that the Siemens Software Center searches for.”
-
ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan“The high-severity vulnerability, tracked as CVE-2026-110936 (CVSS v4 score: 8.4), could allow an attacker to place a specially-crafted DLL in a directory the application searches, resulting in execution of malicious code with the same privileges as the affected service.”
-
Siemens security advisory (AV26-1063)“Siemens has reported that CVE-2026-110936 is being exploited in the wild.”
-
Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks“The vulnerability, tracked as CVE-2026-110936, exists because the program doesn’t properly restrict the locations it searches for DLL files.”
Indicators reported together
named in the same reports- 2.27.248[.]127in 2 reports
- 96.62.218[.]59in 2 reports
- hxxps://www.siemens[.]com/cert/operational-guidelines-industrial-securityin 1 report
- hxxps://www.siemens[.]com/industrialsecurityin 1 report
- hxxps://www.siemens[.]com/cert/advisoriesin 1 report
- hxxps://www.siemens[.]com/productcert/terms-of-usein 1 report
- wizardexpensive[.]comin 1 report
- 4.0.9[.]8in 1 report
Copy these 8 indicators · defanged
Also named with it: CVE-2026-106931, CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656
Thanks — we review every report.