Siemens Software Center flaw abused in ClickFix attacks

Siemens says a DLL-loading flaw in its Software Center download-and-licensing client is being abused in active malware attacks. The bug, CVE-2026-110936, is a DLL search-order weakness (CWE-427): Software Center loads helper DLLs from an uncontrolled path, so a local attacker who can drop a file in that directory runs code with the application's privileges. If you run Siemens Software Center, update to 4.0.9.8 now.

The primary source is Siemens' own disclosure, published October 19, 2026 in advisory SSA-580366, reported via SecurityWeek. The CVE itself was published October 15. Scores differ by version: Siemens rates it 8.4 (CVSS v4), while the CVSS v3.1 base score is 6.7.

Exploitation status

Siemens says the flaw is being exploited as part of the Romulus multi-platform ClickFix campaign. The technique is DLL side-loading: attackers pair a legitimate, validly signed copy of Software Center with their own malicious DLLs, and the signed binary loads them from its own folder at launch. Forescout's prior Romulus research describes the same campaign delivering LegionLoader through DLL side-loading against a legitimate Stardock application; Siemens Software Center was not named in that report, which suggests it was added to the toolkit later.

Siemens stresses an important nuance: the malicious bundle did not come through its distribution channels, and it has no indication any Siemens system, product or update channel was breached. The vulnerability was reported to Siemens by Huntress researcher Jose Oregon.

Action checklist

1. Update Siemens Software Center to 4.0.9.8. Installed clients receive the fix automatically on next launch — confirm it applied rather than assuming it did.
2. Because the abused executable is legitimately signed, do not rely on file-hash blocklists. Hunt for the behavior: unexpected DLLs in the Software Center directory and anomalous child processes from a signed Siemens binary.
3. Pull the IOCs and infection indicators from Siemens' blog post and SSA-580366, and sweep endpoints that run Software Center.
4. Treat any host showing Romulus/LegionLoader artifacts as compromised and isolate it for full response.

Context

ClickFix — tricking a user into pasting an attacker's command, usually via a fake "fix" or CAPTCHA prompt — keeps showing up as the delivery stage in front of otherwise unremarkable loaders. We've tracked it through a fake ChatGPT GPT dropping a RAT, a Ghost CMS campaign, and UAC-0277's Lunex stealer runs in Ukraine. What's new here is the lure vehicle: a signed enterprise software client, side-loading attacker DLLs, so the malicious code inherits the trust of a Siemens-signed process.