CVE-2026-110936, Siemens Software Center: a ClickFix campaign runs a genuine signed copy of the application and side-loads its own DLLs, and Siemens confirms exploitation (CVSS 4.0 8.4)
Siemens confirms exploitation of a Software Center DLL side-loading flaw; attackers bring their own signed copy
Analysis
Siemens ProductCERT says it has validated active exploitation of CVE-2026-110936, a DLL side-loading flaw in Siemens Software Center that Siemens fixed in version 4.0.9.8 and described in advisory SSA-580366 of 2026-10-15 (Siemens ProductCERT, 2026-10-19). The advisory scores it CVSS 4.0 8.4 (6.7 on CVSS 3.1, with a local vector and high privileges required) and lists every version before V4.0.9.8 as affected (Siemens ProductCERT, 2026-10-15). The attackers did not rely on a copy already on the victim's PC: they used a genuine, validly signed copy of Software Center and placed their own files next to it, chosen as a carrier because it is signed and trusted and because version 3.5.8.7, the latest at the time, loaded helper files from its own folder without checking them; the Siemens program itself was not modified, and Siemens says no Siemens system, product or update channel was breached to its knowledge (Siemens ProductCERT, 2026-10-19). Siemens labels the activity the Romulus multi-platform ClickFix campaign and names no actor (Siemens ProductCERT, 2026-10-19); one address that Siemens lists as the distribution channel of its malware bundle also appears among the ROMULUS hosts in Forescout's write-up of a ClickFix delivery platform, which does not mention Siemens software, and Forescout says it has no evidence that its panel is related to RomulusLoader, the malware Proofpoint reported (Forescout Vedere Labs, 2026-10-15). Huntress documented the same chain with other signed applications on 2026-09-28 and warned to expect more signed hosts (Huntress, 2026-09-28).
Triage: a real installation runs from the Siemens install location; the same executable running from the user profile's Programs folder, started by msiexec, with unexpected files beside it or start-up entries on a PC that never had the product, is the abuse (Siemens ProductCERT, 2026-10-19).
Cited evidence
The attackers used a genuine copy of Siemens Software Center with a valid signature and placed their own files next to it.
No Siemens system, product or update channel was breached to our knowledge.
Existing installations update automatically the next time they start.
Detect on folder and behaviour, not on the Siemens file fingerprint
Unfortunately, we (and you) should expect more costumes.
we have no evidence that this panel is related to the RomulusLoader reported by
Sources4
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.