Attackers exploit Siemens Software Center flaw in active ClickFix malware campaign

Siemens has confirmed the active exploitation of CVE-2026-110936, a DLL side-loading vulnerability in Siemens Software Center, the company’s tool for downloading, installing and managing its software.

Siemens first published its security advisory on 15 October 2026, giving the flaw reported by Jose Oregon from Huntress Labs a CVSS v4.0 score of 8.4.

On 17 October, it updated the advisory to tell customers that version 4.0.9.8 resolves the issue, and a blog post warning about active exploitation followed on 19 October.

“The attackers used a genuine copy of Siemens Software Center with a valid signature and placed their own files next to it. They chose this program as a carrier because it is signed and trusted, and because version 3.5.8.7, the latest version at the time, loaded helper files from its own folder without checking them,” Siemens wrote.

The executable itself was not tampered with, the company noted.

“No Siemens system, product or update channel was breached to our knowledge. EDR vendors and authorities have been engaged for intelligence sharing, enabling broader detection coverage and coordinated defensive actions,” the company added.

The installer that carried the files, AllMyBasic.msi, was spread outside official channels, and the activity is attributed to the Romulus multi-platform ClickFix campaign.

ClickFix is a tactic that tricks users into pasting and running a malicious command themselves, which lets attackers deliver malware without a browser download or a file the user has to open, and helps them avoid detection by email and endpoint security solutions.

The blog advises people never to paste a command from a web page into Win+R, the Run box or PowerShell, since a legitimate “I am not a robot” check never asks for this.

A shared delivery platform

Last week, Forescout’s Vedere Labs reported that it had found a server hosting a panel called ROMULUS while investigating an incident, and that the panel is a new multi-payload ClickFix delivery platform.

The researchers identified six IP addresses running it, and one of them, 2.27.248[.]127, is the same address Siemens lists as the distribution channel for AllMyBasic.msi.

The panel serves a PowerShell staging script and a trojanized MSI installer carrying a malware loader, and the routes it uses show that “ROMULUS is a reusable delivery backend rather than a single hard-coded malware server,” the researchers wrote. One of the payloads they analyzed, LegionLoader, can collect sensitive information stored in victims’ Chrome browsers.

“The identity of the operator behind the platform and common ownership of the final malware families are unknown. ROMULUS may be a privately operated panel, a commercial cybercriminal delivery service, an affiliate framework, or software that has been copied between operators,” Forescout explained.

Advice for defenders

Defenders are told to block the attacker infrastructure listed in the blog post and to look for SiemensSoftwareCenter.exe launched by msiexec from AppData\Local\Programs. Infected machines should be isolated, the process stopped, its start-up entries removed and passwords reset.

Existing installations update to the fixed version automatically the next time they launch, and Siemens urges customers to download its software only from official sources.

Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!