Attackers exploit Siemens Software Center flaw in ClickFix malware campaign

As of October 19, 2026, attackers are exploiting a vulnerability in Siemens Software Center to deliver malware to Windows PCs, using a legitimate signed binary alongside malicious DLLs in a ClickFix campaign. Siemens Software Center manages the download, installation, activation, and updating of purchased software and can start free trials. On October 19, 2026, Siemens added a link to a blog post describing the in-the-wild exploitation and linked the abuse to the Romulus ClickFix operation, which tricks users into executing malicious commands through fake prompts like bogus CAPTCHA checks. The campaign leverages Siemens Software Center’s lack of DLL search path restrictions, allowing attackers to plant malicious code that runs with the program’s elevated privileges.

Siemens disclosed the vulnerability, tracked as CVE-2026-110936, on October 15, 2026, assigning it a CVSS v4 score of 8.4. The flaw affects versions before 4.0.9.8, which resolves the issue and automatically updates on the next launch. Version 3.5.8.7, the last release before the fix, did not check helper DLLs before loading them, creating an opening for attackers to inject malicious code. On October 19, Siemens added a blog post linking the in-the-wild exploitation to the Romulus campaign, confirming that its software was not tampered with and that the malicious package was not distributed through official channels.

SecurityWeek reports that the vulnerability stems from Siemens Software Center’s failure to restrict DLL search paths, a design flaw that allows local attackers to place malicious DLLs in the program’s folder. When the legitimate Siemens binary loads these DLLs, the attacker’s code executes with the same privileges as the trusted application. Huntress researcher Jose Oregon was credited with reporting the flaw to Siemens, and the company later confirmed that no Siemens system, product, or update channel was breached in the process. Siemens also shared threat intelligence with authorities and EDR providers, providing indicators of compromise (IoCs) and signs of infection in its advisory.

Forescout research identified the Romulus platform operating on servers, including the distribution server tied to the malicious Siemens bundle. The platform was observed delivering LegionLoader malware and a trojanized installer that abused a legitimate Stardock application for DLL side-loading. Forescout noted that the operators of Romulus remain unidentified, suggesting it could be a private tool, a cybercriminal service, an affiliate program, or copied software. Huntress separately reported at least 40 incidents linked to the ClickFix campaign, warning that signed programs from other vendors are likely being misused in similar ways.

In late September 2026, Huntress reported a related ClickFix campaign. While Huntress and Forescout reports did not mention Siemens Software Center, the overlapping infrastructure and similar side-loading techniques suggest the attack may belong to the same broader toolkit.

SecurityWeek reports that because the Siemens binary used in these attacks is legitimate, defenders should focus on detecting suspicious behavior and monitoring associated folders rather than relying on file hashes for detection. Siemens emphasized that its software was not compromised and that the malicious package originated externally. The company’s advisory provides detailed indicators of compromise and infection signs to help organizations mitigate the risk. Siemens advises users of Siemens Software Center to update to version 4.0.9.8, which resolves the vulnerability and applies automatically on the next launch.

“No Siemens system, product or update channel was breached to our knowledge,” the company stated in its advisory.