Siemens has confirmed that CVE-2026-110936, a DLL sideloading vulnerability in Siemens Software Center, is being actively exploited as part of the Romulus “ClickFix” malware campaign, and the US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities catalog on October 20. Siemens said no Siemens system, product or update channel has been breached.
The vulnerability, rated 8.4 on the CVSS v4 scale by Siemens and published the same day in the National Vulnerability Database, stems from an uncontrolled DLL search path in Siemens Software Center, the company’s tool for downloading, installing and managing its software. An authenticated local attacker can place a crafted DLL in a directory the application searches, causing arbitrary code to execute with the application’s privileges.
Siemens first published advisory SSA-580366 on October 15, crediting Jose Oregon of Huntress Labs with reporting the flaw, and updated it on October 17 and again to V1.2 on October 19 to confirm active exploitation and clarify that all releases before V4.0.9.8 are affected.
How the attacks work
According to Help Net Security, the attackers distributed an installer named AllMyBasic.msi outside official Siemens channels, bundling a genuine, validly signed SiemensSoftwareCenter.exe with malicious DLLs that the vulnerable version loads at startup. Victims were lured through the Romulus ClickFix scheme, which uses fake “I am not a robot” checks that trick users into pasting commands into Windows Run or PowerShell.
The Canadian Centre for Cyber Security relayed Siemens’ report of active exploitation in advisory AV26-1063, noting CISA’s October 20 KEV listing.
Who is affected
All Siemens Software Center installations on Windows earlier than version 4.0.9.8 are affected. Existing installations automatically update to the fixed version the next time the application is started, so defenders should verify that the automatic upgrade to 4.0.9.8 has completed on all endpoints as of October 20.
What to do
- Update Siemens Software Center to version 4.0.9.8 or later, and obtain the software only from official Siemens download channels.
- Hunt for SiemensSoftwareCenter.exe launched by msiexec.exe from the AppData\Local\Programs directory, which Help Net Security cites as a sign of compromise, and for unexpected “SM Software Provisioning Service” folders.
- Block the attacker infrastructure listed in the Siemens blog, isolate infected hosts, remove persistence mechanisms and reset passwords.
Siemens ProductCERT cautions that because the binary used in the attacks is genuine and signed, defenders should focus on suspicious behavior, folders and infrastructure rather than relying on file hashes.
What is still unknown
Neither Siemens nor any government advisory has published victim or infection counts. No reporting attributes the Romulus campaign to a named threat actor, and no full technical write-up of the intrusion chain beyond the advisory credit to Huntress Labs has been released as of October 20.
One Response