Siemens: Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks

Siemens Software Center Exploited in Malware Campaign via DLL Side-Loading Vulnerability

Siemens confirmed on Monday that threat actors exploited a vulnerability in its Siemens Software Center a tool used for downloading, installing, and updating licensed software as part of a broader malware campaign. The flaw, tracked as CVE-2026-110936, stems from improper DLL search path restrictions, allowing authenticated local attackers to execute malicious code with the same privileges as the application.

The vulnerability, disclosed on October 15 with a CVSS v4 score of 8.4, was patched in version 4.0.9.8, released two days later. While Siemens initially did not report active exploitation, an updated advisory on Monday revealed that attackers had abused the flaw in the wild.

The attack involved pairing a legitimate, digitally signed copy of Siemens Software Center (version 3.5.8.7) with malicious DLL files. The program, which did not validate these helper files before loading them, executed the attacker-supplied code upon launch. Siemens clarified that its software was not tampered with, nor were its distribution channels compromised.

The company linked the campaign to Romulus, a multi-platform ClickFix operation that tricks users into executing malicious commands via fake prompts (e.g., bogus CAPTCHAs). Forescout and Huntress researchers previously identified Romulus as a delivery platform for malware like LegionLoader and a trojanized Stardock installer, which also used DLL side-loading. While Siemens Software Center was not mentioned in earlier reports, overlapping infrastructure suggests it was added to the same toolkit.

Siemens is sharing indicators of compromise (IoCs) and collaborating with authorities and EDR providers. Due to the legitimate nature of the abused file, defenders are advised to monitor suspicious behavior and associated folders rather than relying on file hashes. The vulnerability was reported by Huntress researcher Jose Oregon.

The campaign highlights the growing use of signed, legitimate applications in malware distribution, with Huntress responding to at least 40 incidents tied to similar attacks. Researchers remain uncertain whether Romulus is a private tool, a criminal service, or an affiliate program.

Source: https://www.securityweek.com/siemens-software-center-vulnerability-exploited-in-clickfix-malware-attacks/

Siemens Digital Industries Software cybersecurity rating report: https://www.rankiteo.com/company/siemenssoftware

"id": "SIE1792449038",
"linkid": "siemenssoftware",
"type": "Vulnerability",
"date": "10/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'industry': 'Industrial Automation/Software',
                        'name': 'Siemens',
                        'type': 'Corporation'}],
 'attack_vector': 'DLL Side-Loading',
 'date_publicly_disclosed': '2023-10-15',
 'description': 'Siemens confirmed that threat actors exploited a '
                'vulnerability in its Siemens Software Center, a tool used for '
                'downloading, installing, and updating licensed software, as '
                'part of a broader malware campaign. The flaw, tracked as '
                'CVE-2026-110936, stems from improper DLL search path '
                'restrictions, allowing authenticated local attackers to '
                'execute malicious code with the same privileges as the '
                'application. The attack involved pairing a legitimate, '
                'digitally signed copy of Siemens Software Center with '
                'malicious DLL files, which the program executed upon launch.',
 'impact': {'systems_affected': 'Siemens Software Center (version 3.5.8.7)'},
 'initial_access_broker': {'entry_point': 'Legitimate Siemens Software Center '
                                          '(version 3.5.8.7) with malicious '
                                          'DLLs'},
 'investigation_status': 'Ongoing',
 'lessons_learned': 'Growing use of signed, legitimate applications in malware '
                    'distribution; need for monitoring suspicious behavior '
                    'rather than relying on file hashes.',
 'post_incident_analysis': {'corrective_actions': 'Patch released, monitoring '
                                                  'enhanced, IoCs shared',
                            'root_causes': 'Improper DLL search path '
                                           'restrictions (CVE-2026-110936)'},
 'recommendations': 'Update to patched version (4.0.9.8), monitor for '
                    'suspicious behavior, collaborate with EDR providers.',
 'references': [{'source': 'Siemens Advisory'},
                {'source': 'Forescout Research'},
                {'source': 'Huntress Research'}],
 'response': {'communication_strategy': 'Advisory updated, IoCs shared',
              'enhanced_monitoring': 'Monitoring suspicious behavior and '
                                     'associated folders',
              'remediation_measures': 'Patch released (version 4.0.9.8)',
              'third_party_assistance': 'Forescout, Huntress'},
 'threat_actor': 'Romulus (ClickFix operation)',
 'title': 'Siemens Software Center Exploited in Malware Campaign via DLL '
          'Side-Loading Vulnerability',
 'type': 'Malware Campaign',
 'vulnerability_exploited': 'CVE-2026-110936'}