How ClickFix Exploits Siemens Software Center CVE-2026-110936

Siemens has confirmed active exploitation of CVE-2026-110936, a DLL sideloading vulnerability in Siemens Software Center, by threat actors using a ClickFix delivery platform called Romulus. Attackers placed a malicious DLL next to a genuine, signed copy of the Siemens application, tricking it into loading their code and ultimately deploying a remote access trojan. The fix — version 4.0.9.8 — applies automatically when the application starts, but systems that were compromised before the patch need immediate investigation.

What Is Siemens Software Center and What Was Disclosed?

Siemens Software Center is a utility that lets users download, install, activate, and update purchased Siemens software. It is a legitimate, commonly installed management tool that runs with appropriate system privileges — which is exactly why attackers wanted to use it.

On October 15, 2026, Siemens ProductCERT published advisory SSA-580366, disclosing that all versions of Siemens Software Center prior to V4.0.9.8 load DLL files from an uncontrolled search path [1]. The advisory was updated on October 19, 2026 to add a reference to confirmed active exploitation. The vulnerability was discovered and reported by Jose Oregon of Huntress Labs.

How Does the DLL Sideloading Vulnerability Actually Work?

DLL sideloading (CWE-427) exploits a predictable loading behavior in Windows applications. When a program calls for a DLL by name without specifying its full path, Windows searches a sequence of directories — and if the application's own folder appears early in that search order, a file placed there takes priority over the real system DLL.

In this case, Siemens confirmed that versions prior to 4.0.9.8 searched their own directory for helper files at startup without verifying those files. An attacker could drop a malicious archive.dll into the same folder as SiemensSoftwareCenter.exe, and the application would load it automatically — executing the attacker's code with the privileges the Siemens process already holds [1].

The CVSS v3.1 score is 6.7 with vector AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. Under CVSS v4.0, the score rises to 8.4 (AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). The local attack vector means an attacker needs to already be on the machine — but the ClickFix social engineering technique resolves that requirement by tricking the user into running the initial payload themselves.

How Were Attackers Delivering the Payload Through ClickFix?

The social engineering side of this campaign is what makes the local-only vulnerability usable at scale. The Romulus platform — a multi-payload ClickFix delivery backend first documented by Forescout Vedere Labs on October 14, 2026 — serves lures that present victims with a fake verification prompt [3]. Some variations used malicious ChatGPT Custom GPTs to direct users to a fake URL carrying the ClickFix lure [2].

When the victim pastes the provided command into a Run dialog or PowerShell terminal, the command runs PowerShell code that calls msiexec.exe to download and execute AllMyBasic.msi. That MSI package contains both a genuine signed copy of Siemens Software Center (version 3.5.8.7, which was current at the time) and the malicious archive.dll. Because the signed Siemens binary is what launches — not some unsigned random executable — early behavioral detection has a harder time flagging the activity as malicious. This is a deliberate choice by the attackers.

As Siemens ProductCERT noted in their blog post: "They chose this program as a carrier because it is signed and trusted, and because version 3.5.8.7, the latest version at the time, loaded helper files from its own folder without checking them" [4]. A real-world attack exploiting trust in a software vendor's own product, with the vendor's binary doing the malicious loading.

This matters for living-off-the-land detection — defenders who only flag unsigned binaries or unknown executables may miss this entirely.

Who Is Affected and What Versions Were Vulnerable?

The CVSS scoring authority is Siemens ProductCERT. The vulnerability is classified under CWE-427 (Uncontrolled Search Path Element). Both CVSS v3.1 and v4.0 scores are provided in the advisory, which is reasonably uncommon — worth noting that the v4.0 score (8.4) is higher than the v3.1 score (6.7) partly because v4.0 weighs certain local privilege conditions differently. If your organization's vulnerability management process uses only one scoring version, check which one it is and use the advisory score for that version before deciding how to triage this.

Organizations that have never intentionally installed Siemens Software Center should consider any installation of it as a suspicious signal rather than a legitimate software deployment.

What Are the Confirmed Indicators of Compromise?

Siemens ProductCERT published IOCs directly in their exploitation blog post [4]. These are confirmed infrastructure indicators from the Romulus ClickFix campaign.

The inactive distribution server no longer serves files, but machines that downloaded from it before it went offline may still be infected. Searching logs for any past connections to 2.27.248[.]127 is still worthwhile.

What Detection Signals Should Defenders Prioritize?

Siemens ProductCERT was explicit on this point: detecting this attack on the Siemens binary fingerprint alone won't work because the file itself is genuine [4]. Detection needs to focus on behavior and file system artifacts.

Behavioral warning signs Siemens identified:

• SiemensSoftwareCenter.exe running from AppData\Local\Programs and launched by msiexec.exe
• A folder named SM Software Provisioning Service inside AppData\Local\Programs
• Files named activate.bak or statinfosta.DB alongside SiemensSoftwareCenter.exe
• A folder named FTSuite containing ftc.uml inside AppData\Local
• Network connections to 96.62.218[.]59
• Siemens Software Center appearing in startup entries or Task Scheduler on machines where it was never intentionally installed

For organizations with a mature EDR deployment, a process tree rule covering parent process msiexec.exe → child SiemensSoftwareCenter.exe → grandchild network connection should fire reliably on active infections.

What Should Organizations Do Right Now?

The patch path here is unusually straightforward: starting Siemens Software Center triggers an automatic update to version 4.0.9.8. Siemens also offers the updated version as a direct download from the official portal at sw.siemens.com [1]. The catch is that systems already compromised won't benefit from the patch without incident response first.

Siemens ProductCERT's immediate recommendations:

• Update Siemens Software Center to V4.0.9.8 or later.
• Only download Siemens software from official Siemens sources — the attackers distributed the signed legitimate binary alongside their malicious DLL through unofficial channels.
• Block 96.62.218[.]59 and wizardexpensive[.]com at the firewall, proxy, and DNS resolver.
• Search logs for connections to all three IOC IPs, including the inactive distribution server 2.27.248[.]127.
• Look for unexpected DLL files alongside Siemens Software Center executables outside the default installation folder.
• If compromise indicators are found: isolate the system, stop the process, remove the startup entry and scheduled task, and reset passwords before reconnecting.

This is also a useful moment to review user education around social engineering tactics. The ClickFix delivery mechanism doesn't exploit a browser bug or an email client vulnerability — it works by convincing a user to open a Run dialog and paste a command. No legitimate CAPTCHA verification ever asks a user to do this.

What Remains Unknown or Unverified?

Several details are not currently established from the available primary sources. The scope of infections — how many machines have been compromised — has not been publicly quantified by Siemens or any third-party source. Attribution for the Romulus platform operator is unknown; Forescout's research noted that the identity of the operator and common ownership of the malware families distributed through it remain unidentified [3].

The specific RAT deployed in this campaign is not named in available public sources. Siemens confirmed a remote access trojan is the final payload based on Huntress and Forescout reporting, but the specific tool or family has not been identified in the materials published through October 20, 2026.

There is also no indication from Siemens that the ClickFix campaign specifically targeted industrial or OT environments because of the Siemens brand. The software is used broadly across industries, and the choice appears to have been opportunistic — a signed, trusted binary with a known loading flaw — rather than a targeted ICS attack.

Strategic Implications

The Romulus campaign illustrates something that vulnerability advisories alone don't fully capture: the practical risk floor for a local-only vulnerability can be much lower than the CVSS attack vector suggests, when social engineering removes the "physical access required" assumption. CVE-2026-110936 scores as a local privilege vulnerability needing high-privilege access. In practice, a user pasting a ClickFix command in a Run dialog satisfies those requirements in seconds.

The attacker's choice of Siemens Software Center is notable specifically because of its trust properties, not because of the software's market reach. The signed binary gave the attack chain a veneer of legitimacy that an unsigned random executable wouldn't. This pattern — borrowing trust from legitimate software to execute malicious code — has become a standard feature of DLL sideloading campaigns in 2025–2026.

For defenders, this is an argument for process-ancestry detection rather than binary trust. A signed binary is not a safe binary if something else placed a hostile DLL in its search path first. Process parent-child rules, combined with network egress monitoring to flag new external connections from unexpected parent processes, offer more reliable detection than file signature checks alone. Organizations already running behavioral EDR rules for living-off-the-land patterns should add msiexec → signed application → network egress to their detection library as a priority action from this campaign.

Sources & References

1. Siemens ProductCERT — SSA-580366: DLL Sideloading Vulnerability in Siemens Software Center (Published 2026-10-15, Last Updated 2026-10-19)
2. The Hacker News — ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan (Ravie Lakshmanan, 2026-10-20)
3. Infosecurity Magazine — ROMULUS Malware Server Leverages ClickFix to Deliver Multiple Payloads (2026-10-14)
4. Siemens ProductCERT Blog — Active Exploitation of CVE-2026-110936 in Siemens Software Center (2026-10-19)
5. CVE.org — CVE-2026-110936 Record