Signed Siemens app hijacked: the ClickFix alert (19/10/2026)
A genuine Siemens executable with a valid signature, used as the carrier for malware. The patch takes a minute. The lesson about your allowlisting rules takes longer.
In short
On 19 October 2026 Siemens confirmed active exploitation of CVE-2026-110936, a DLL side-loading flaw in Siemens Software Center, the utility that installs and updates Siemens software on engineering workstations[2]. No Siemens system or update channel was breached: the attackers took a genuine, validly signed copy of the program, distributed it outside official channels, and placed their own DLL files next to it, which the vulnerable version loaded at start-up without any check[2]. Advisory SSA-580366, published on 15 October and updated on 19 October, fixes the flaw in version 4.0.9.8[1], and CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on 20 October with a remediation due date of 3 November 2026[3].
The mechanism, without the jargon
A Windows program needs libraries, the .dll files, to run. If it looks for them in its own folder first without checking who wrote them, then anyone who can drop a file into that folder decides what code runs. That is exactly what Siemens Software Center did up to version 3.5.8.7, the latest release at the time[2].
Siemens is explicit: the Siemens program was not modified, the malicious code sits in the DLL files the attackers supplied[2]. Siemens scores the flaw 6.7 out of 10 on CVSS v3.1 and 8.4 on CVSS v4.0[1]. It was reported by Jose Oregon of Huntress Labs[1].
Why your antivirus stayed silent
This is the part that matters even if you own no Siemens software at all. The executable carried a valid Siemens digital signature. Any security rule that says « allow anything signed by a known vendor » let the whole chain through. Siemens puts it in one line: detect on folder and behaviour, not on the Siemens file fingerprint, because the file itself is genuine[2].
It is the same lesson as the Windows zero-day of 13 October, where the download warning simply disappeared: when Windows loses its trust signal, behaviour is all you have left to watch. A valid signature answers « who wrote this file? », never « what does it do, and who put it there? ».
The real entry point: the fake « I am not a robot » check
Siemens attributes the campaign to Romulus, a ClickFix-style operation[2]. The pattern: a web page shows a fake anti-robot check and asks the visitor to copy a command and paste it into the Windows Run box (Win+R) or into PowerShell. The command downloads the malicious bundle, here an installer named AllMyBasic.msi, which drops the signed Siemens program together with the booby-trapped archive.dll[2].
No patch protects against that first step: the employee opens the door. The rule to circulate fits in one sentence, and it is Siemens' own: a real anti-robot check never asks you to paste a command[2].
Am I affected? What to look for on a PC
Siemens publishes indicators you can check directly[2]:
- « Siemens Software Center » in the start-up apps or Task Scheduler of a PC that never had it installed;
- a folder named SM Software Provisioning Service inside the Programs subfolder of %LocalAppData%;
- files called activate.bak or statinfosta.DB sitting next to SiemensSoftwareCenter.exe;
- a folder called FTSuite containing a file ftc.uml inside %LocalAppData%;
- network connections to 96.62.218[.]59 or wizardexpensive[.]com, both still reachable when the advisory was published; the distribution channel 2.27.248[.]127 is inactive, but a machine that downloaded from it before it went offline may still be infected.
One more useful behavioural signature: SiemensSoftwareCenter.exe running from the Programs subfolder of %LocalAppData% and started by msiexec[2]. If any of this shows up, isolate the machine, stop the process before removing the start-up entry and the scheduled task, then reset passwords[2].
What it changes for an SME, country by country
Patching is the easy part: every existing Siemens Software Center installation updates itself on next start-up, and version 4.0.9.8 can also be downloaded from the Siemens site[1]. The expensive part is what follows if a machine was compromised.
Two obligations then apply, and they come from different texts. For an entity in scope of NIS2, Article 23 of Directive (EU) 2022/2555 requires an early warning without undue delay and within 24 hours of becoming aware of a significant incident, then an incident notification within 72 hours[5]. The recipient is the authority designated by national transposition: the CCB in Belgium, ANSSI in France, RDI and NCSC in the Netherlands, ILR in Luxembourg. If you are unsure whether you are in scope, start with our sector analysis: NIS2 Belgium: manufacturing, who is actually in scope? For Brussels-based firms, our local page is here.
If personal data could have been accessed or exfiltrated, Article 33 GDPR requires notification to the supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals; past 72 hours, the notification must state the reasons for the delay[6]. The competent authority is the APD/GBA in Belgium, the CNIL in France, the Autoriteit Persoonsgegevens in the Netherlands, the CNPD in Luxembourg. The two clocks run in parallel, not one after the other.
One last yardstick, useful outside the United States too: CISA set 3 November 2026 as the remediation deadline for US federal agencies[3]. Two weeks for a government estate is the pace to quote back to a provider who promises a rollout « next quarter ». If your maintenance is outsourced, the question is the same one we raised about your IT provider's remote access.
Do this week
- Start Siemens Software Center on every engineering workstation: the update to 4.0.9.8 happens at start-up[1]. Then read the version number, do not assume it.
- Search for the SM Software Provisioning Service and FTSuite folders inside %LocalAppData% on every Windows machine, Siemens software or not.
- Block 96.62.218[.]59, wizardexpensive[.]com and 2.27.248[.]127 on firewalls, proxies and DNS resolvers, then search your logs for all three indicators[2].
- Send the whole team a one-line rule: never paste a command from a web page into Win+R or PowerShell.
- Ask your IT provider in writing: do your allowlisting rules rely on the vendor signature alone? If so, on what date do we move to behavioural detection?
- Write down, on a single page, who calls whom and in what order during an incident, with the authority's name and the deadline that applies to your entity. That page does not get written 24 hours before the clock runs out.
At CyberNovaLabs.io
This is not a Siemens product problem: it is a problem of trust granted to a signature. That is exactly where we work, with an inventory of your machines and allowlisting rules, a written anti-ClickFix rule for your staff, and the one-page incident sheet that says who to notify, within what deadline and with what information, for each of the four countries we cover. That is the content of our cybersecurity service for SMEs; engagements are quoted per case. Thirty minutes is enough to find out where you stand: book a meeting.
Sources
- Siemens ProductCERT, avis SSA-580366 — DLL Sideloading Vulnerability in Siemens Software Center (publié le 15/10/2026, mis à jour le 19/10/2026)
- Siemens ProductCERT, Active Exploitation of CVE-2026-110936 in Siemens Software Center (19/10/2026)
- NVD / CISA Known Exploited Vulnerabilities — CVE-2026-110936 (ajoutée le 20/10/2026, échéance 03/11/2026)
- SecurityWeek, Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks (20/10/2026)
- Directive (UE) 2022/2555 (NIS2), article 23 — obligations de notification
- Règlement (UE) 2016/679 (RGPD), article 33 — notification d'une violation de données
Qualified meetings, no lock-in.
Criteria in writing before launch, pay per meeting or monthly, stop with a simple email.
Read next
Introducers and B2B appointment setting: the legal framework
Three arrangements share the same name in sales conversations, and only one of them is a statutory status you cannot contract out of. Here is what the French, Belgian and Dutch texts say, and the single criterion that moves a contract from one regime to the other.
Read the article →October 23, 2026 · 8 min readB2B appointment setting for law firms: what the rules allow
Conduct rules bite before the GDPR does. In France and Belgium an outside provider cannot call your prospects for you. Here is what remains workable, country by country, and the grid to apply before a meeting is booked.
Read the article →October 22, 2026 · 7 min readCritical PHP flaws: your website is affected (21/10/2026)
Two critical vulnerabilities in PHP, the engine under most small-business websites, allow unauthenticated remote code execution. Patches shipped on 21 October 2026. What to check this week, and what will never be fixed.
Read the article →October 22, 2026 · 9 min readNIS2 Netherlands: are software vendors and IT providers in scope?
Publishing software is not a listed category in Dutch law. Running a client's infrastructure, hosting it, monitoring it, is. Here is how to settle your own case in ten minutes, with the Dutch dates, the right regulator and the main-establishment rule that decides who inspects you.
Read the article →October 21, 2026 · 7 min readYour IT provider's remote access: critical flaw (15/10/2026)
On 15 October 2026 BeyondTrust disclosed a critical flaw in Remote Support, the tool many IT providers use to take control of their clients' machines. The next day CISA added it to the catalogue of actively exploited vulnerabilities. The SME affected does not host that tool: its supplier hosts it.
Read the article →October 21, 2026 · 9 min readNIS2 France: are construction firms in scope?
Construction divisions 41, 42 and 43 appear in no NIS2 annex, and as of 21 October 2026 France has no transposition law. But division 33 is in there, your French activity code changes on 1 January 2027, and transfer fraud rose 93% in 2025. What actually matters for a building firm.
Read the article →