Siemens has confirmed active exploitation of a high-severity vulnerability in Siemens Software Center. Attackers are pairing a legitimate, digitally signed Siemens executable with malicious DLL files, turning trusted software into a vehicle for malware execution.
The vulnerability, CVE-2026-110936, affects Siemens Software Center versions earlier than 4.0.9.8. Siemens assigned the flaw a CVSS v4 score of 8.4 and released the corrected version on October 17.
HOW THE ATTACK WORKS
Siemens Software Center is used to download, install, activate, and update purchased Siemens software. The vulnerable application searches an insufficiently controlled set of locations when loading dynamic-link libraries.
An attacker with local authenticated access can place a specially crafted DLL in one of those locations. When the legitimate Siemens executable starts, it may load the attacker-controlled library and execute its code with the application’s privileges.
In observed attacks, threat actors distributed a genuine, signed copy of Software Center alongside malicious DLLs. The trusted signature belonged to the legitimate executable; it did not cover the malicious files placed beside it.
This technique is known as DLL side-loading. It can help malicious code appear less suspicious because execution begins through a legitimate application from a recognized vendor.
CLICKFIX LURES DELIVERED THE MALICIOUS PACKAGE
Siemens linked the activity to Romulus, a multiplatform ClickFix delivery operation.
ClickFix attacks display deceptive instructions—often presented as CAPTCHA, browser, or troubleshooting prompts—that persuade victims to copy and execute commands. Those commands then retrieve or launch the attacker’s payload.
Related research from Forescout found Romulus infrastructure delivering multiple payloads, including LegionLoader and a separate package that abused signed Stardock software for DLL side-loading. Siemens identified infrastructure overlapping with that operation.
Attribution remains unresolved. Researchers have not determined whether Romulus is controlled by one threat actor, sold as a criminal service, shared through an affiliate program, or used independently by multiple groups.