---
schema: 1
kind: vulnerability
title: "CVE-2026-110936, Siemens Software Center: a ClickFix campaign runs a genuine signed copy of the application and side-loads its own DLLs, and Siemens confirms exploitation (CVSS 4.0 8.4)"
headline: "Siemens confirms exploitation of a Software Center DLL side-loading flaw; attackers bring their own signed copy"
summary: >
  Siemens ProductCERT says it validated active exploitation of CVE-2026-110936, a DLL side-loading flaw in Siemens Software
  Center versions before V4.0.9.8, which it fixed in advisory SSA-580366 of 2026-10-15; installed copies update themselves
  the next time the application starts. The attackers did not abuse an installed copy: they delivered a genuine, validly
  signed copy of version 3.5.8.7 with their own files beside it through what Siemens calls the Romulus multi-platform ClickFix
  campaign, so the check that finds it is behaviour on any Windows PC, not a Software Center inventory.
discovered_at: "2026-10-20T03:36:00Z"
updated_at: null
event_date: "2026-10-19"
run_id: 2026-10-20T0256Z-intel
priority: notable
immediate_action: null
tags: [vulnerabilities, actively-exploited, phishing, patch-available]
regions: [global]
sectors: []
entities: []
techniques: [T1204.004, T1574.001, T1218.007, T1547.001, T1053.005]
affected_products: ["Siemens Software Center"]
cves:
  - id: CVE-2026-110936
    cvss: "8.4 (CVSS 4.0; 6.7 on CVSS 3.1)"
    epss: "0.00135"
    type: logic-flaw
    vector: local
    auth: admin-required
    status: [exploited, patch-available]
    affected: "all versions before V4.0.9.8"
    fixed: "V4.0.9.8 (installed copies update automatically the next time the application starts)"
sources:
  - url: "https://productcert.siemens.com/news/2026/10/19/active-exploitation-of-cve-2026-110936-in-siemens-software-center/"
    publisher: "Siemens ProductCERT"
    date: "2026-10-19"
    role: primary
  - url: "https://cert-portal.siemens.com/productcert/html/ssa-580366.html"
    publisher: "Siemens ProductCERT (SSA-580366)"
    date: "2026-10-15"
    role: primary
  - url: "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat"
    publisher: "Huntress"
    date: "2026-09-28"
    role: corroborating
  - url: "https://www.forescout.com/blog/romulus-analysis-of-a-new-multi-payload-clickfix-delivery-platform/"
    publisher: "Forescout Vedere Labs"
    date: "2026-10-15"
    role: corroborating
closed_sources: []
evidence:
  - quote: "The attackers used a genuine copy of Siemens Software Center with a valid signature and placed their own files next to it."
    publisher: "Siemens ProductCERT"
    source_url: "https://productcert.siemens.com/news/2026/10/19/active-exploitation-of-cve-2026-110936-in-siemens-software-center/"
  - quote: "No Siemens system, product or update channel was breached to our knowledge."
    publisher: "Siemens ProductCERT"
    source_url: "https://productcert.siemens.com/news/2026/10/19/active-exploitation-of-cve-2026-110936-in-siemens-software-center/"
  - quote: "Existing installations update automatically the next time they start."
    publisher: "Siemens ProductCERT"
    source_url: "https://productcert.siemens.com/news/2026/10/19/active-exploitation-of-cve-2026-110936-in-siemens-software-center/"
  - quote: "Detect on folder and behaviour, not on the Siemens file fingerprint"
    publisher: "Siemens ProductCERT"
    source_url: "https://productcert.siemens.com/news/2026/10/19/active-exploitation-of-cve-2026-110936-in-siemens-software-center/"
  - quote: "Unfortunately, we (and you) should expect more costumes."
    publisher: "Huntress"
    source_url: "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat"
  - quote: "we have no evidence that this panel is related to the RomulusLoader reported by"
    publisher: "Forescout Vedere Labs"
    source_url: "https://www.forescout.com/blog/romulus-analysis-of-a-new-multi-payload-clickfix-delivery-platform/"
verification: single-source
sourcing_note: >
  Siemens ProductCERT is the first-party source for its own product and the only party reporting exploitation of Siemens
  software; Huntress, credited by Siemens for reporting the flaw, documents the same delivery pattern with other signed
  applications. Forescout's write-up of a ClickFix platform named ROMULUS does not mention Siemens software, but one address in
  Siemens' indicator list is among Forescout's ROMULUS hosts. Siemens gives no first-use date, victim geography or actor.
confidence: high
references:
  - "2026-10-04/chatgpt-custom-gpt-clickfix-sideloaded-in-memory-rat"
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: A
  credibility: 2
watchlist_hit: false
actions: []
updates: []
migrated_from: null
---

Siemens ProductCERT says it has validated active exploitation of CVE-2026-110936, a DLL side-loading flaw in Siemens Software Center that Siemens fixed in version 4.0.9.8 and described in advisory SSA-580366 of 2026-10-15 ([Siemens ProductCERT, 2026-10-19](https://productcert.siemens.com/news/2026/10/19/active-exploitation-of-cve-2026-110936-in-siemens-software-center/)). The advisory scores it CVSS 4.0 8.4 (6.7 on CVSS 3.1, with a local vector and high privileges required) and lists every version before V4.0.9.8 as affected ([Siemens ProductCERT, 2026-10-15](https://cert-portal.siemens.com/productcert/html/ssa-580366.html)). The attackers did not rely on a copy already on the victim's PC: they used a genuine, validly signed copy of Software Center and placed their own files next to it, chosen as a carrier because it is signed and trusted and because version 3.5.8.7, the latest at the time, loaded helper files from its own folder without checking them; the Siemens program itself was not modified, and Siemens says no Siemens system, product or update channel was breached to its knowledge ([Siemens ProductCERT, 2026-10-19](https://productcert.siemens.com/news/2026/10/19/active-exploitation-of-cve-2026-110936-in-siemens-software-center/)). Siemens labels the activity the Romulus multi-platform ClickFix campaign and names no actor ([Siemens ProductCERT, 2026-10-19](https://productcert.siemens.com/news/2026/10/19/active-exploitation-of-cve-2026-110936-in-siemens-software-center/)); one address that Siemens lists as the distribution channel of its malware bundle also appears among the ROMULUS hosts in Forescout's write-up of a ClickFix delivery platform, which does not mention Siemens software, and Forescout says it has no evidence that its panel is related to RomulusLoader, the malware Proofpoint reported ([Forescout Vedere Labs, 2026-10-15](https://www.forescout.com/blog/romulus-analysis-of-a-new-multi-payload-clickfix-delivery-platform/)). Huntress documented the same chain with other signed applications on 2026-09-28 and warned to expect more signed hosts ([Huntress, 2026-09-28](https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat)).

**Exposure:** any Windows PC whose user pasted a command from a web page into the Run box or PowerShell, whether or not Siemens software is installed there, because the attackers bring their own copy; installed Software Center versions before V4.0.9.8 are affected as well until the application starts and updates itself ([Siemens ProductCERT, 2026-10-19](https://productcert.siemens.com/news/2026/10/19/active-exploitation-of-cve-2026-110936-in-siemens-software-center/)).

**Detection:** in process-creation telemetry, the signed Software Center executable running from a folder under the user profile's local Programs directory and started by msiexec, which Siemens names as the signal; in image-load and file telemetry, unexpected DLL and data files beside that executable outside the default installation folder; in persistence telemetry, a Software Center start-up entry or scheduled task on a PC that never had the product, and a service-named folder that the malware creates under the same Programs directory ([Siemens ProductCERT, 2026-10-19](https://productcert.siemens.com/news/2026/10/19/active-exploitation-of-cve-2026-110936-in-siemens-software-center/)). Siemens says to detect on folder and behaviour rather than on the file's fingerprint, because the file itself is genuine; where a PC matches, it says to isolate it, stop the process first, then remove the start-up entry and the task and reset passwords.

**Triage:** a real installation runs from the Siemens install location; the same executable running from the user profile's Programs folder, started by msiexec, with unexpected files beside it or start-up entries on a PC that never had the product, is the abuse ([Siemens ProductCERT, 2026-10-19](https://productcert.siemens.com/news/2026/10/19/active-exploitation-of-cve-2026-110936-in-siemens-software-center/)).

**Defender takeaway:** update Software Center to V4.0.9.8 or later wherever it is installed, and hunt for the execution pattern above on every Windows endpoint, since the carrier is delivered with the lure and patching an installed copy does not stop it; the same hunt covers the other signed applications Huntress describes, and the lever at the front of the chain is the paste step into the Run box or PowerShell ([Siemens ProductCERT, 2026-10-19](https://productcert.siemens.com/news/2026/10/19/active-exploitation-of-cve-2026-110936-in-siemens-software-center/); [Huntress, 2026-09-28](https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat)).