Siemens Software Center is on KEV. The PLC this week is a WAGO web login, not the S7 web server.

16–23 October 2026. ProductCERT 19 Oct — CVE-2026-110936 in Software Center exploited via ClickFix; KEV 20 Oct due 3 Nov; ICSA-26-295-03 22 Oct. Same week: WAGO PFC/CC100 8.8 root from a low-priv WBM login until 4.10.0; Moxa AIG-302 1.4.1; Hitachi SYS600 10.8. CISA’s 22 Oct Siemens pack is last Tuesday’s ProductCERT, not a new finding. Edge tickets are Arista VCO and Plex, not a PLC.

RWP Ventures · 2026-10-23 · 21 min read · priority 9.0

The finding that belongs at the top of a Siemens, TIA, and engineering-PC queue is not last week’s fridge campaign. On 19 October Siemens ProductCERT published that CVE-2026-110936 in Siemens Software Center is under active exploitation. SSA-580366 is V1.2. The load-path close has been V4.0.9.8 since 17 October. On 20 October CISA added the CVE to KEV (due 3 November, ransomware use Unknown). On 22 October CISA republished the advisory as ICSA-26-295-03. [20 October Daily Top](/posts/2026-10-20-siemens-ssc-cve-2026-110936-clickfix/) covered the ProductCERT post; this weekly is the KEV row plus the ICSA plus the rest of the ICS week, not a reprint.

Do not collapse five facts. The Siemens file is genuine and signed; the malicious code is in attacker DLLs (archive.dll) dropped beside 3.5.8.7. Hashing SiemensSoftwareCenter.exe misses it. The CVSS vector is local / high-privilege (6.7 v3.1 / 8.4 v4.0, CWE-427); what ProductCERT validated in the wild is a ClickFix drop, not a plant admin planting a DLL. 4.0.9.8 closes the load path on existing installs at next start; it does not clean an AppData copy started by msiexec. Romulus is a Siemens label. This is an endpoint, including an engineering workstation. It is not confirmed process impact, not SSA-591731, not a PLC write.

The original PLC ticket this window is 20 October. CISA’s bulletin listed ICSA-26-293-02 WAGO OS Linux, republishing CERT@VDE VDE-2026-096. CVE-2026-80466 is OS command injection in the web-based management routing page, CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N), stored then executed by a root helper. CVE-2026-88850 is missing authorization on protected PROFIBUS settings, 8.1. Affected firmware 1.0.0 up to but not including 4.10.0 on CC100, PFC100 G2, PFC200 G2, Touch Panel 600, Edge Controller, WP400. Close: 4.10.0 (FW32). No known exploitation. A low-privileged WBM login is enough. That is a controller, not an installer.

Same 20 October CISA drop, original work: ICSA-26-293-03 Moxa AIG-302 ThingsPro Edge ≤ 1.4.0 — hardcoded key CVE-2026-109813 8.1 (adjacent, unauthenticated) and secrets API CVE-2026-109812 6.8; fix 1.4.1; CISA: not remotely exploitable. ICSA-26-293-01 HMS PEAK-System PCAN Windows drivers ≤ 5.1.2, local kernel-crash set, fix 5.1.4. ICSA-26-293-04 Hitachi Energy MicroSCADA X SYS600 — OS login can read/modify SYS600 objects (CVE-2026-9853, 7.8) and engineering-tool access can become Windows administrator (CVE-2026-9854, 7.8); 10.8 plus the deployment-guide mitigation, which still applies on 10.8 for 9853.

ICSA-26-293-05 Hitachi Energy RTU500 is not last week’s EOL 11.x / CVE-2026-8065 story. It is CISA’s 20 October conversion of PSIRT 8DBD000259 (vendor 1 September, 12.7.8 note 29 September) on supported CMU firmware 12.7.1–12.7.7 / 13.5–13.8. Header 8.8 (CVE-2026-6653 libxml2 use-after-free). Floors remain 12.7.8 / 13.9.1 (13.8.3 on the 13.8 branch; 13.7.9 when available). No known exploitation.

CISA’s 22 October ICS list is last Tuesday’s Siemens ProductCERT pack converted to ICSAs (CROSSBOW V6.0, S7-1500 web with no firmware, Industrial Edge V1.28.1, WinCC 8.8, 1518 MFP Linux-subsystem CVSS 10 with no fix, APE1808 firewall image). Treat it as a CISA visibility event, not a second Patch Tuesday. The one 22 October ICSA that is not last week’s Siemens pile is ICSA-26-295-01 Kiloview E3 NDI encoder, header 9.9, firmware < 1.30, nine CVEs, command injection as root after a web login; sectors Communications / IT; close 1.30. Not a PAC.

CERT-FR’s CERTFR-2026-ALE-012 last-version stamp moved to 16 October — recommendation rewrite, not a new product class. Danfoss AK-SM/AK-SC, Copeland xweb, Dixell xweb remain. Campaigns still “probably in progress.” Factory-reset on EOL internet exposure is still insufficient. No CVE in the alert.

The only CONFIRMED in-the-wild tickets with a 16–23 October KEV timestamp that OT operators should treat as live IT-to-OT doors are not PLCs except the Software Center row. Catalog freeze this morning: 2026.10.21 / 1754, dateReleased 2026-10-21T14:04:39Z. Newest add is still 20 October: Software Center 110936, Plex 96652 / 96654 / 96655 / 96656, SiteGuard 106931. [21 October Daily Top](/posts/2026-10-21-plex2shell-kev-assume-compromise/) on Plex. [23 October Daily Top](/posts/2026-10-23-arista-velocloud-cve-2026-114625/) on Arista VCO CVE-2026-114625 — vendor-confirmed exploited SQLi, not on KEV. None of those are ICS malware.

Do not upgrade Software Center, WAGO 80466, or Kiloview into FrostyGoop. Last week’s standing hunt is unchanged except the engineering-PC ClickFix: internet-reachable PLCs and engineering-client abuse named in AA26-097A and AA26-231A. CVE-2026-3869 on M580 / M580 Safety still has no CISA ICSA as of 23 October morning. Hitachi FACTS FCP/GWS still has no versioned patch in the 17 September ICSA.

OT threat posture

An engineering-software installer with a valid Siemens signature produced CONFIRMED in-the-wild code execution this window. That is a higher-confidence endpoint / engineering-workstation incident class than any of Tuesday’s CVSS 8.x PLC rows, which CISA and the vendors still tag with no known public exploitation. It is not a higher-confidence process incident than last week’s French refrigeration event. Exposure, engineering-path abuse, and a KEV’d plant VPN remain the standing hunt. Ransomware still hurts plants by killing the Windows, mail, and hypervisors OT depends on. SafePay (AA26-293A, 20 October) is edge-device ransomware against critical-infrastructure IT, not a process write. No public primary source this week documented a new ladder-logic change or a new ICS-specific wiper.

1. Most significant development

Siemens ProductCERT’s 19 October exploitation notice on CVE-2026-110936, because a vendor validated wild use of a signed engineering-software loader, CISA put it on KEV on 20 October (due 3 November), and CISA republished it as ICSA-26-295-03 on 22 October — the only OT-adjacent KEV add this window.

Why this outranked the rest of the week: WAGO 80466 is the 20 October PLC ticket — authenticated low-priv WBM to root on a Linux controller, versioned 4.10.0 the same day — and it would have been the lead in a week without confirmed exploitation. It is still a management-plane command injection, not a named campaign. Hitachi SYS600 7.8 is a local SCADA-host finding with a 10.8 close. RTU500 8.8 is CISA converting a 1 September supported-train advisory whose floors (12.7.8 / 13.9.1) were already in last week’s isolate-and-migrate sentence. The 22 October Siemens ICSA pack is last week’s Patch Tuesday with USG letterhead. Kiloview 9.9 is a video encoder. Score for the week: 9.0. WAGO-as-lead would have been ~8.2 (8.8, real PLC, versioned FW32, no exploitation). SYS600-as-lead ~7.4. RTU500-CISA-conversion ~7.2. The 20 October Daily Top already scored Software Center 8.9 as a single-day story; this weekly is the KEV / ICSA increment and the ICS week around it, not a second 8.9 on the same 19 October paragraph.

2. Adversary / campaign activity

CONFIRMED (this window, engineering workstation, not process): Siemens Software Center CVE-2026-110936. ProductCERT 19 October: genuine signed binary, attacker DLLs beside it, ClickFix delivery, Romulus label, no Siemens distribution breach to Siemens’s knowledge. IOCs as published 19 October: 96.62.218[.]59 (active), wizardexpensive[.]com (active), 2.27.248[.]127 (inactive, AllMyBasic.msi). SHA-256 AllMyBasic.msi f4d7c5321bb0d1bda439304a753bcf9b467b98ca53c7e9493b9c2c3451092e4a; archive.dll 3fdcc7d7d049a89711fb31fb236940a1c5a09d899143ffd20c3c41fb1f2cf491. Host signs: Software Center in Startup/Task Scheduler on a PC that never had it; SM Software Provisioning Service under AppData\Local\Programs; activate.bak / statinfosta.DB; FTSuite / ftc.uml; SiemensSoftwareCenter.exe from AppData started by msiexec. Named crew: none beyond Siemens’s Romulus label. Forescout’s 15 October ROMULUS panel overlaps at 2.27.248[.]127; Forescout did not attribute the panel. Final implant family: UNKNOWN. Process impact: none claimed.

CONFIRMED (continuing, OT process, not this week’s increment): CERTFR-2026-ALE-012. 16 October is a recommendation rewrite. Product class unchanged from 13 October: Danfoss AK-SM/AK-SC, Copeland xweb, Dixell xweb. Named actor: none. CVE: none. Extra-France victims of the 11–12 October night: UNKNOWN until another CSIRT publishes.

CONFIRMED (this window, not ICS malware): SafePay, AA26-293A, 20 October. CISA/FBI/USSS. Edge devices and internet-exposed systems, including at critical-infrastructure organizations. Not a PLC write. Integrity Tech AA26-281A remains the 8 October USG story. ConnectWise / SkyKick OAuth is [19 October weekly IT](/posts/2026-10-19-weekly-it-broker-skykick-beyondtrust-ivanti/) — an industrial tenant is an IT compromise of Microsoft 365 until logs show a process write. We do not have it.

Continuing, still the current hunt set:

• AA26-097A (April, updated 22 July): Iran-affiliated actors using Studio 5000 / EcoStruxure Control Expert / TIA Portal against internet PLCs. CONFIRMED as USG. No new victim set this window.
• FBI/EPA 30 July water PSA: MicroLogix 1100/1400, seven states. CONFIRMED as PSA. Not this week’s news.
• AA26-231A (19 August): recon and capability development on US S7-200/300/400/1200. CONFIRMED as USG wording. Now nine weeks old. No new victim set this window.

UNKNOWN a 16–23 October named victim with a confirmed ladder-logic, protection-setting, WAGO-PROFIBUS, SYS600-object, or RTU500 change.

3. Vulnerabilities and active exploitation

CONFIRMED (Siemens ProductCERT 19 Oct + CISA KEV 20 Oct + ICSA 22 Oct) — exploited engineering loader.

CONFIRMED (CISA ICS + CERT@VDE, 20 October) — original work this window.

CONFIRMED (CISA ICS, 22 October) — last Tuesday’s Siemens pack, plus Kiloview.

ICSMA-26-295-01 InterSystems IRIS for Health is medical. It is on the 22 October CISA list. It is not this briefing’s plant-floor lead.

CONFIRMED (active exploitation, mixed OT-adjacent / not ICS): KEV freeze 2026.10.21 / 1754. Software Center 110936 due 3 November. Plex 96654 / 96656 due 23 October (today). Plex 96652 / 96655 and SiteGuard 106931 due 3 November / 23 October. Last week’s Ivanti 104935 was due 16 October; BeyondTrust 102764 and Fortinet 61624 were due 19 October. CVE-2026-114625 is not on KEV. No WAGO, Moxa, SYS600, RTU500, Kiloview, CROSSBOW, or S7-web CVE is on that catalog this morning.

Still missing from CISA ICS: Schneider CVE-2026-3869 on M580 / M580 Safety. Six-week watch item. Primary remains SEVD-2026-251-04. Hitachi FACTS ICSA-26-260-03 still names no patched FCP version.

4. ICS / SCADA impact

CONFIRMED process impact this window: none new. Last week’s French grocery refrigeration remains the last well-sourced availability hit. CERT-FR’s 16 October stamp did not add a victim, a CVE, or a country.

No CONFIRMED new loss-of-view or loss-of-control event dated 16–23 October in Siemens ProductCERT, VDE-2026-096, Hitachi 8DBD000249/000259, or CISA ICS for Software Center, WAGO, SYS600, RTU500, or Kiloview.

What would become process impact, if exploited on an exposed or poorly segmented box:

• Software Center 110936 → code execution on the Windows PC that runs TIA / Step 7 / the installer. That is an engineering workstation. It is not a confirmed logic download. Hunt the folder before you call it a PLC event.
• WAGO 80466 → root on the Linux controller that runs the machine. 88850 → PROFIBUS addressing the line did not plan. That is the closest this week comes to a process-capable finding. CISA and VDE still report no known exploitation.
• SYS600 9853/9854 → SCADA objects and the Windows host under the SCADA. Local. Sandia found it; nobody has published a victim.
• RTU500 6653 and the mTLS/credential cluster → supported-train substation RTU, network-reachable. Floors exist. Not last week’s unpatchable 11.x.
• S7-1500 web 63350–63357 → actions the logged-on user was already allowed to take. Restrict the web server. It is not snap7-from-the-WAN.
• Kiloview 109122 → root on a video encoder. Communications gear. Do not brief it as a PAC or a PLC.
• Arista VCO 114625 / SafePay / SkyKick against a utility or plant tenant → IT compromise at an industrial company. ASSESSED IT-to-OT path. Not a process event in those advisories.

Prior water PLC tampering (July) and the UK small-generator outage (late July, disclosed August) remain the last well-sourced availability hits before the fridge week. They are not this week’s news.

5. IT-to-OT exposure

Seven doors this week, in the order operators can actually hunt:

1. Siemens Software Center on any engineering PC, including one that never had a corporate install. 4.0.9.8 on the real install; hunt AppData / msiexec / the three Siemens indicators. KEV due 3 November. [20 October Daily Top](/posts/2026-10-20-siemens-ssc-cve-2026-110936-clickfix/).
2. WAGO WBM on CC100 / PFC / TP600. Low-priv login is enough. Restrict the management ports to named engineering hosts until 4.10.0. Export PROFIBUS config before the window.
3. Internet-facing refrigeration system managers — Danfoss AK-SM/AK-SC, Copeland xweb, Dixell xweb. CERT-FR 16 October did not retire the 13 October order. Public IP off; VPN or filtered contractor; EOL replace.
4. Arista on-prem VeloCloud Orchestrator. CVE-2026-114625, exploited, Enterprise Read Only is enough, floors 5.2.3.18 / 6.1.3.10 / 6.4.2.12. September’s 5.2.3.16 / 6.4.2.8 do not close it. Hosted is already patched; on-prem is not. [23 October Daily Top](/posts/2026-10-23-arista-velocloud-cve-2026-114625/).
5. Ivanti Connect Secure / BeyondTrust Remote Support / PAN-OS that is the plant, contractor, or jump-host path. Last week’s due dates (16 / 19 October) have passed. Rebuild conditions from those dailies still apply. SafePay’s edge-device initial access is the same door class.
6. CROSSBOW / SAC that brokers IED access. V6.0. CISA conversion does not change the floor.
7. Hitachi SYS600 host and RTU500 CMU on the supported train. 10.8 plus the deployment-guide mitigation; 12.7.8 / 13.9.1. Last week’s 11.x isolate-and-migrate is a different ticket.

Ignition, engineering workstations, and internet-facing 44818/102/502/2222 remain the standing hunt from AA26-097A / AA26-231A. That hunt does not reset because CISA put an installer on KEV.

6. Sector impact

• Process manufacturing / discrete with Siemens engineering: Software Center hunt first. 4.0.9.8 is the load-path close, not the AppData close. S7-1500 web server still off the WAN until SSA-591731 ships. Industrial Edge V1.28.1. WinCC 8.0 U11 / 8.1 U7. Last week’s ArmorBlock 3.013 and Ignition 8.1.55 / 8.3.9 are still open.
• Discrete / machine builders on WAGO: inventory firmware against 4.10.0. WBM off the cell VLAN until the window. PROFIBUS baseline. Touch Panel 600 and WP400 count.
• Electric / transmission: CROSSBOW / SAC V6.0 (now with an ICSA number). RTU500 supported train 12.7.8 / 13.9.1; 11.x still isolate-and-migrate. SYS600 10.8 plus 2.1.7.5. S7-1500 web server off the WAN. APE1808 as the PAN-OS/FortiGate train. FACTS FCP/GWS still has no versioned firmware. AA26-231A S7 exposure is still the Siemens PLC lead.
• Oil and gas / chemical midstream: WAGO if that is the skid controller. Last week’s Sage RTU C3414-500-S02L0 and TMS7 / TopHAT 7.8 are still open. Moxa AIG-302 1.4.1 if that gateway is on a tank or well pad.
• Food / grocery / cold-store 3PL: CERT-FR class is not closed. 16 October did not add a CVE. Independent probe temperature. Software Center if the site also runs Siemens packaging lines.
• Building / commercial facilities: last week’s Pro-face STW6000 (no patch) and APOGEE/Desigo SSA-333035. WAGO TP600 if that is the panel.
• Water / small SCADA: WAGO; Moxa AIG-302; last week’s Milo 1.1.5 and Malcolm past v26.08.0. Ivanti against a utility VPN is an IT ticket until logs show a process write.
• Broadcast / video over IP on a plant VLAN: Kiloview E3 1.30. Do not treat it as a control-system finding; do treat an encoder with a management UI on the OT VLAN as an exposure.

7. Defensive priorities

1. Hunt Siemens Software Center the way ProductCERT wrote it — folder, parent msiexec, the three indicators — then 4.0.9.8 on the real install. KEV due 3 November.
2. Internet-facing PLC eradication — still number two. VPN or jump host, never the controller. AA26-097A / AA26-231A have not been withdrawn.
3. WAGO WBM to named engineering hosts; book 4.10.0 (FW32) after a bench test. Export PROFIBUS first.
4. Refrigeration UIs off the internet — CERT-FR order, not a CVE wait. Danfoss, Copeland xweb, Dixell xweb. Factory reset plus remove the hole. EOL is replace.
5. CROSSBOW / SAC V6.0. S7-1500 web server: restrict until SSA-591731 ships.
6. Hitachi SYS600 10.8 plus the deployment-guide mitigation. RTU500 12.7.8 / 13.9.1 on the supported train; 11.x still migrate.
7. Moxa AIG-302 1.4.1. HMS PCAN 5.1.4 on engineering PCs that talk CAN.
8. On-prem VeloCloud Orchestrator to 5.2.3.18 / 6.1.3.10 / 6.4.2.12. Do not close on September’s 5.2.3.16.
9. Open from prior weeks: ArmorBlock 3.013, Ignition 8.1.55 / 8.3.9, Sage RTU C3414-500-S02L0, Pro-face isolate, Milo 1.1.5, N-Tron 3.11.1, TMS7 7.8, Armatura One 4.7.2, MikroTik 7.24 (CVE-2026-84411, still not KEV), FACTS GWS (no versioned patch), M580 SEVD-2026-251-04 (still no ICSA), Ivanti 104935 rebuild, BeyondTrust 102764.
10. Do not wait for ICS-specific malware. Last week’s process loss did not need a named wiper. This week’s exploited loader did not need one either.

8. What changed from last week

[Last week (ending 16 October)](/posts/2026-10-16-weekly-ot-danfoss-copeland-siemens/) was CERT-FR’s 13 October Copeland/Dixell expansion of a confirmed cold-chain compromise, Siemens Patch Tuesday (Crossbow V6.0, S7-1500 web with no fix, Industrial Edge 9.1, WinCC 8.8), Rockwell ArmorBlock 3.013, Schneider Sage RTU with a versioned floor and Pro-face with none, and CISA’s Ignition / Milo / EseeCloud / Malcolm set. The exploited activity was Ivanti 104935 due 16 October.

This week the original OT work is Siemens confirming Software Center is being used as a signed ClickFix loader (19 Oct), CISA putting that CVE on KEV (20 Oct, due 3 Nov) and converting it to ICSA-26-295-03 (22 Oct), plus CISA’s 20 October original pack — WAGO 8.8, Moxa 8.1, HMS PCAN, SYS600 7.8 — and CISA converting Hitachi’s supported-train RTU500 advisory and last Tuesday’s Siemens pile. CERT-FR 16 October is a recommendation rewrite, not a new product. No new USG PLC campaign update. No new FBI/EPA water PSA. CVE-2026-3869 on M580 still has no ICSA. FACTS GWS still has no versioned patch. The exploited activity moved from Ivanti 104935 due 16 October to Software Center 110936 due 3 November, with Arista VCO 114625 exploited and not on KEV. AA26-231A is nine weeks old.

9. What OT defenders should watch next

Whether CISA’s KEV due date on 110936 produces a BOD 26-04 forensics expectation that engineering-PC owners actually run. Whether ProductCERT adds a victim census, a final implant family, or a second signed binary. Whether VDE-2026-096 / 80466 is observed on a WBM that was left on a cell VLAN. Whether Hitachi ships 13.7.9. Whether Siemens ships SSA-591731 firmware, or operators just leave the S7 web server off. Whether CERT-FR revises ALE-012 with a CVE or a non-French CSIRT joint. Whether CISA finally republishes CVE-2026-3869. Whether Hitachi publishes a versioned FCP/GWS patch. Whether Arista 114625 lands on KEV. Q3 industrial ransomware counts. Any AA26-097A or water-PSA refresh.

10. RWP assessment

High confidence: this week’s OT lead is CVE-2026-110936 as exploited (Siemens 19 October), listed on KEV (20 October, due 3 November), and converted to ICSA-26-295-03 (22 October) — a signed engineering-software loader used in ClickFix, not a PLC write and not confirmed process impact. High confidence: WAGO CVE-2026-80466 is a real Linux-controller root from a low-privileged WBM login, versioned at 4.10.0, with no public exploitation as of this retrieval. High confidence: CISA’s 22 October Siemens ICSA list is last week’s ProductCERT pack, not a new vulnerability set. High confidence: exposed controllers and engineering paths in AA26-097A / AA26-231A remain the incident class that has USG evidence. Moderate confidence: a non-trivial Software Center / ClickFix hit rate exists on engineering PCs because signed Siemens binaries are trusted by default and 4.0.9.8 does not clean AppData. Moderate confidence: Arista 114625, leftover Ivanti/BeyondTrust, and SafePay’s edge initial access are the IT-to-OT doors that will produce this week’s actual tickets. Low confidence: a new OT malware family dropped in the last seven days. Labeling a manufacturer ransomware victim, a Software Center AppData hit, a WAGO WBM login, a SYS600 local finding, or a Kiloview encoder as “OT compromise” without process evidence remains a briefing error. Last week’s French fridge event remains the last process exception because the process evidence is in the CSIRT text.

This assessment covers 16–23 October 2026 and was published 23 October 2026.