Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks

What it is

CVE-2026-110936 is a DLL search-path flaw in Siemens Software Center, the tool that downloads, installs, activates and updates purchased Siemens software and starts free trials. Siemens rated it CVSS v4 8.4 in an advisory published October 15. On Monday it added a link to a blog post confirming in-the-wild exploitation.

How it works

The program does not restrict where it looks for DLLs. In the attacks, a legitimate, validly signed copy of Software Center was bundled with attacker-supplied DLLs. At startup it loaded them from its own folder. Siemens says version 3.5.8.7, the newest release at the time, did not validate these helper files before loading.

The advisory describes the generic attack as an authenticated local attacker planting a DLL and getting code run with Software Center's privileges. In these attacks the victim runs the bundle themselves.

Siemens ties the delivery to Romulus, a multi-platform ClickFix platform. ClickFix uses fake prompts, such as bogus CAPTCHA checks, that tell users to paste and run commands. Forescout found Romulus on several servers, including the one Siemens named as the distribution server for the malicious bundle. Forescout saw it deliver LegionLoader and a trojanized installer that side-loaded through a legitimate Stardock application.

Preconditions / Affected

• Software Center versions before 4.0.9.8, including 3.5.8.7.
• Siemens says its systems, products and update channels were not breached, and the malicious package did not come through its distribution channels.

What to do

• Get to 4.0.9.8. Siemens updated the advisory on October 17 to name this fix, and installed copies receive it automatically the next time they are launched.
• Use the IoCs and infection signs in Siemens' blog post. Siemens recommends hunting on suspicious behavior and the folders tied to the malware, not on file hashes, because the Siemens binary is genuine.
• Siemens is sharing threat intelligence with authorities and EDR providers.

Caveats

• The Huntress and Forescout reports do not mention Siemens Software Center. The link to Romulus rests on shared infrastructure and a similar side-loading method, so the page says Siemens software "may have been added" to the toolkit.
• Forescout could not determine who runs Romulus. It could be a private tool, a service sold to criminals, an affiliate program, or copied software.
• Huntress earlier saw the Stardock package in a late-September campaign that used rogue ChatGPT Custom GPTs to lure users to ClickFix pages. It abused signed Canon and then Stardock programs to deploy a RAT, with at least 40 incidents. Huntress believes signed programs from other vendors are probably being misused too.
• The page gives no count of Siemens-related victims.