Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks

The vulnerability CVE-2026-110936 in Siemens Software Center arises from the software's failure to properly restrict DLL search locations, allowing an authenticated local attacker to plant malicious DLLs that are loaded and executed with the same privileges as the Software Center application. Attackers exploited this by bundling a genuine, digitally signed Siemens Software Center executable with attacker-supplied malicious DLLs, which the software loaded from its own folder without validation. Siemens disclosed the vulnerability on October 15, 2026, assigning it a CVSS v4 score of 8.4, and released version 4.0.9.8 as a fix. The attacks are part of the Romulus ClickFix campaign, which uses fake prompts to lure users into executing malicious commands, ultimately delivering malware payloads. Siemens confirmed that their software and distribution channels were not compromised, and the malicious packages were distributed outside official channels. Siemens is collaborating with authorities and endpoint detection and response providers to share indicators of compromise and detection guidance.

An authenticated local attacker can execute arbitrary code with the privileges of Siemens Software Center by planting malicious DLLs in search paths the software trusts. This can lead to system compromise on affected Windows PCs. The attack leverages a legitimate signed executable, complicating detection based on file signatures alone. The vulnerability has been exploited in the wild as part of a broader malware campaign (Romulus ClickFix) that uses social engineering to trick users into running malicious commands. Siemens confirmed no breach of their own systems or update channels, indicating the malicious payloads were distributed externally.

Siemens has released version 4.0.9.8 of Software Center, which resolves the DLL search path vulnerability. Users with the application installed will receive the fix automatically upon launching the software. Defenders should focus on detecting suspicious behaviors and monitoring folders associated with the malicious DLLs rather than relying solely on file hashes, since the legitimate Siemens executable is used in the attack. Siemens is sharing indicators of compromise and detection guidance with security vendors and authorities. Applying the official update is the primary mitigation step.