Siemens Software Center Flaw Exploited in Romulus ClickFix Malware Campaign

Siemens confirmed on Monday that threat actors have exploited a security flaw in its Software Center application to distribute malware. The industrial automation giant disclosed that attackers paired a genuine, signed copy of the software with malicious dynamic link libraries to infect Windows computers. This activity is linked to the Romulus operation, a multi-platform campaign that relies on deceptive user interactions.

The vulnerability, identified as CVE-2026-110936, stems from improper restrictions on the locations where the program searches for DLL files. An authenticated local attacker can place a malicious DLL in one of these directories, causing the software to execute their code with the same privileges as the application. Siemens assigned the flaw a CVSS v4 score of 8.4, classifying it as high severity, when it first issued an advisory on October 15.

Context and Background

Siemens updated its advisory two days after the initial disclosure to inform customers that version 4.0.9.8 resolves the security issue. Users who already have the application installed will receive the fix automatically the next time they launch the program. The company clarified that the malicious package was not spread through its official distribution channels and that no Siemens systems or update channels were breached.

The attacks involved using version 3.5.8.7 of the software, which did not validate helper files before loading them. Attackers supplied their own malicious DLL files alongside the legitimate, digitally signed Siemens program. When the application started, it loaded these attacker-provided files from its own folder, effectively bypassing standard security checks. This method allowed the malware to execute without tampering with the original Siemens binary.

Who Is Affected

The exploitation is part of the Romulus ClickFix campaign, which targets users through fake prompts such as bogus CAPTCHA checks. These prompts instruct victims to paste and execute malicious commands on their own devices, facilitating the initial compromise. Siemens has linked the specific Software Center attacks to this broader operation, highlighting the sophistication of the threat actors involved.

Huntress researcher Jose Oregon is credited with reporting the vulnerability to Siemens. The company is currently sharing threat intelligence with authorities and endpoint detection and response providers to help mitigate the impact. Siemens also published a blog post listing indicators of compromise and signs that a computer may have been infected, aiding in the identification of affected systems.

What should you do?

Because the Siemens file used in the attacks is legitimate, Siemens recommends that defenders focus on suspicious behavior and the folders associated with the malware rather than relying on file hashes. The company advises monitoring for unusual activity in directories where the Software Center operates. Security teams should review system logs for unexpected DLL loading events or process injections that do not align with normal software update patterns.

Background: Endpoint detection and response (EDR)

Endpoint detection and response examples include blocking PowerShell scripts that download payloads, isolating devices showing abnormal memory access, and rolling back file changes. These tools monitor behavior, not just signatures, to stop advanced threats that evade standard security controls.

Read the full guide: Endpoint Detection and Response Examples: How EDR Stops Hidden Threats

What to do and how to stay safe: Siemens

• Verify that Siemens Software Center is updated to version 4.0.9.8 or later to ensure the DLL search order vulnerability is patched.
• Monitor endpoint logs for unauthorized DLL loading within the Siemens Software Center directory, especially following user-initiated commands.
• Educate users to ignore fake CAPTCHA or system prompts that ask them to paste and execute code in command-line interfaces.
• Review endpoint detection alerts for processes running with elevated privileges that originate from unexpected or temporary directories.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-110936?

It is a vulnerability in Siemens Software Center that allows local privilege escalation through DLL search order hijacking, rated 8.4 on CVSS v4.

How was the vulnerability exploited?

Attackers paired a legitimate, signed copy of the software with malicious DLL files, which the program loaded without validation, executing the attacker's code.

Is there a fix available?

Yes, Siemens released version 4.0.9.8 to resolve the issue, and it is deployed automatically to existing installations upon launch.