Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks

A few sentences overstated how the package spread. I'll correct those and bring the full piece inside the word range.Threat actors have exploited a vulnerability in Siemens Software Center as part of a malware campaign, Siemens revealed on Monday in an update covered by SecurityWeek's report from senior managing editor Eduard Kovacs. Siemens Software Center handles the download, installation, activation, and updating of software that customers have bought, and it can also be used to start free trials. The flaw is tracked as CVE-2026-110936.

This piece is for Siemens Software Center customers and people starting a free trial in that application, and for defenders tracking ClickFix lures. It covers CVE-2026-110936, versions 3.5.8.7 and 4.0.9.8, the Romulus link Siemens drew, and the Forescout and Huntress findings.

What broke in Siemens Software Center Vulnerability

CVE-2026-110936 exists because Siemens Software Center does not properly restrict the locations it searches for DLL files. An authenticated local attacker could plant a malicious DLL in one of those folders and have their code executed with the same privileges as Software Center. Siemens disclosed the flaw on October 15 in an advisory with a CVSS v4 score of 8.4. Two days later the company said version 4.0.9.8 resolves the issue. Users who already have the application installed receive the fix automatically the next time they launch it.

Attackers paired a legitimate copy of the program, which carried a valid digital signature, with malicious DLL files they supplied themselves. When the program started, it loaded the attacker-provided files from its own folder. Version 3.5.8.7, the newest release at the time, did not validate these helper files before loading them. Siemens said its software was not tampered with, and the malicious package was not spread through Siemens' distribution channels. "No Siemens system, product or update channel was breached to our knowledge," the company said.

Who is exposed by Siemens Software Center Vulnerability

Software Center downloads, installs, activates, and updates software customers have bought, and it can start free trials, so customers and trial users both launch the affected program. The October 15 advisory describes an authenticated local attacker who plants a malicious DLL in a searched folder so that code runs with Software Center's privileges. The advisory did not mention in-the-wild exploitation until Monday, when Siemens added a link to a new blog post describing attacks that paired the signed program with attacker DLLs.

Siemens links the attacks to Romulus, a multi-platform ClickFix campaign. ClickFix attacks rely on fake prompts, such as bogus CAPTCHA checks, that instruct users to paste and execute malicious commands on their own devices. Huntress responded to at least 40 incidents in a late-September campaign that used rogue ChatGPT Custom GPTs to lure users to ClickFix pages. Signed programs from Canon and later Stardock were abused to side-load malicious code that ultimately deployed a RAT. Huntress researcher Jose Oregon is credited with reporting the vulnerability to Siemens.

What to do now about Siemens Software Center Vulnerability

Users who already have Siemens Software Center installed will receive version 4.0.9.8 automatically the next time they launch the application. Two days after the October 15 advisory, Siemens told customers that this release resolves CVE-2026-110936, which has a CVSS v4 score of 8.4. Version 3.5.8.7, the newest release at the time, did not validate helper files before loading them from the program's own folder. Launching the installed application is the path Siemens gave those existing installs in the updated advisory.

Because the Siemens file used in the attacks is legitimate, Siemens recommends that defenders focus on suspicious behavior and the folders associated with the malware instead of relying on file hashes. The signed program can be genuine while the DLL files supplied beside it are not. Siemens is sharing threat intelligence with authorities and EDR providers. Its blog post lists indicators of compromise and signs that a computer may have been infected. The malicious package was not spread through Siemens' distribution channels.

How the Siemens Software Center Vulnerability issue works

Attackers supplied a legitimate copy of Siemens Software Center that carried a valid digital signature, plus malicious DLL files of their own. When the program started, it loaded the attacker-provided files from its own folder. Version 3.5.8.7 did not validate those helper files before loading them. A malicious DLL loaded from a searched folder executes with the same privileges as Software Center. Siemens said its software was not tampered with, and the malicious package was not spread through its distribution channels.

Siemens has linked the activity to Romulus. ClickFix attacks rely on fake prompts, such as bogus CAPTCHA checks, that instruct users to paste and execute malicious commands on their own devices. Last week Forescout described Romulus as a ClickFix delivery platform that can serve several different malware payloads. Forescout found it running on several servers, including the one Siemens identified as the distribution server for the malicious bundle containing its software. Forescout saw the platform deliver the LegionLoader malware, as well as a trojanized installer that leveraged a legitimate Stardock application for DLL side-loading.

What is still unknown about Siemens Software Center Vulnerability

Forescout's researchers could not determine who runs Romulus. They said it could be a private tool, a service sold to cybercriminals, an affiliate program, or software copied by different threat actors. Siemens links these attacks to Romulus, and Forescout saw that platform on the distribution server Siemens named, but neither point identifies the operator. The October 15 advisory scored the bug CVSS v4 8.4 and, two days later, named version 4.0.9.8. The advisory did not mention in-the-wild exploitation until Monday.

Siemens Software Center is not mentioned in the Huntress report or the Forescout report. Overlapping infrastructure and a similar side-loading approach suggest the program may have been added to the same toolkit. Huntress responded to at least 40 incidents involving Canon and later Stardock, after rogue ChatGPT Custom GPTs led users to ClickFix pages and the side-loaded code deployed a RAT. Huntress believes signed programs from other vendors are probably being misused as well, and it did not name those vendors.