Siemens Software Center flaw exploited to side-load malware in ClickFix attacks

Siemens has confirmed that attackers are exploiting a vulnerability in Siemens Software Center, its tool for downloading, installing, activating and updating licensed software, to run malicious code on victims' machines as part of a ClickFix malware campaign, SecurityWeek reported on October 19. The flaw, tracked as CVE-2026-110936 and rated 8.4 under CVSS v4, was disclosed on October 15, and Siemens acknowledged in-the-wild exploitation four days later in a blog post.

What happened

According to SecurityWeek, attackers bundled a legitimate, validly signed copy of Siemens Software Center with malicious DLL files they supplied. When the program starts, it loads those DLLs from its own folder, so the attacker's code runs under the cover of a trusted, signed application.

Siemens linked the activity to Romulus, a multi-platform ClickFix campaign. ClickFix lures, such as fake CAPTCHA checks, trick users into pasting and running malicious commands themselves. Forescout research published the previous week described Romulus as a multi-payload delivery platform that delivered the LegionLoader malware and a trojanized installer side-loading DLLs through a legitimate Stardock application. Forescout found Romulus on several servers, including the one Siemens identified as distributing the malicious bundle, but could not determine who operates it.

SecurityWeek also noted that Huntress reported a related campaign in late September that used rogue ChatGPT Custom GPTs to lure victims to ClickFix pages and abused signed Canon and Stardock programs to deploy a remote access trojan. Huntress responded to at least 40 incidents. Neither report mentioned Siemens Software Center; SecurityWeek suggested, based on shared infrastructure and similar techniques, that it may have been added to the same toolkit.

Technical details

The issue stems from Software Center not properly restricting the locations it searches for DLL files. An authenticated local attacker could plant a malicious DLL in one of those folders and have it executed with the same privileges as the application. Version 3.5.8.7, the newest release at the time, did not validate these helper files before loading them. Huntress researcher Jose Oregon is credited with reporting the flaw.

Siemens stressed that its software was not tampered with, that the malicious package was not distributed through its channels, and that, to its knowledge, no Siemens system, product or update channel was breached. The company said it is sharing threat intelligence with authorities and EDR vendors.

What to do

• Upgrade Siemens Software Center to 4.0.9.8 or later. Siemens updated its advisory on October 17 to announce the fix, and existing installations should receive it automatically the next time the application launches.
• Because the signed Siemens executable itself is legitimate, hash-based blocking is not enough. Hunt for suspicious behavior and the folders associated with the malware, using the indicators published in Siemens' blog post.
• Train users to recognize ClickFix lures, since the campaign depends on victims running commands themselves.