Attackers exploit Siemens Software Center flaw in active ClickFix malware campaign - Help Net Security
Siemens has confirmed the active exploitation of CVE-2026-110936, a DLL side-loading vulnerability in Siemens Software Center, the company’s tool for downloading, installing and managing its software.
Siemens has confirmed the active exploitation of CVE-2026-110936, a DLL side-loading vulnerability in Siemens Software Center, the company’s tool for downloading, installing and managing its software.
Siemens first published its security advisory on 15 October 2026, giving the flaw reported by Jose Oregon from Huntress Labs a CVSS v4.0 score of 8.4.
The company has attributed the activity to the Romulus multi-platform ClickFix campaign.
According to Huntress, some of these campaigns have leveraged malicious ChatGPT Custom GPTs to direct victims to a fake URL responsible for serving a ClickFix lure, which when copied and executed by the victim, runs PowerShell code to drop an MSI installer that abuses DLL sideloading to ultimately deploy a remote access trojan.
ClickFix is a tactic that tricks users into pasting and running a malicious command themselves, which lets attackers deliver malware without a browser download or a file the user has to open, and helps them avoid detection by email and endpoint security solutions.
Siemens urged Software Center customers update to version 4.0.9.8, which contains a fix for the flaw.
The panel allows cybercriminals to deploy ClickFix tactics into an entire ecosystem which can be repeatedly used to deliver multiple forms of malware to victims.
Specifically, threat actors have been found leveraging "msiexec.exe" to launch "AllMyBasic.msi," which then executes "SiemensSoftwareCenter.exe." The activity has been attributed to a ClickFix delivery platform called Romulus , which was detailed by Forescout last week as being used to deliver Legion Loader and other malware using DLL sideloading.
The Siemens blog , published on October 19, detailed how attackers are targeting CVE-2026-110936 (CVSS 8.4) to load malicious DLL files into a directory that the Siemens Software Center searches for.
The installer that carried the files, AllMyBasic.msi, was spread outside official channels, and the activity is attributed to the Romulus multi-platform ClickFix campaign.
What happened
Siemens has confirmed the active exploitation of CVE-2026-110936, a DLL side-loading vulnerability in Siemens Software Center, the company’s tool for downloading, installing and managing its software.
Siemens first published its security advisory on 15 October 2026, giving the flaw reported by Jose Oregon from Huntress Labs a CVSS v4.0 score of 8.4.
What changed
The company has attributed the activity to the Romulus multi-platform ClickFix campaign.
According to Huntress, some of these campaigns have leveraged malicious ChatGPT Custom GPTs to direct victims to a fake URL responsible for serving a ClickFix lure, which when copied and executed by the victim, runs PowerShell code to drop an MSI installer that abuses DLL sideloading to ultimately deploy a remote access trojan.
Who is affected
ClickFix is a tactic that tricks users into pasting and running a malicious command themselves, which lets attackers deliver malware without a browser download or a file the user has to open, and helps them avoid detection by email and endpoint security solutions.
Siemens urged Software Center customers update to version 4.0.9.8, which contains a fix for the flaw.
Why it matters
The panel allows cybercriminals to deploy ClickFix tactics into an entire ecosystem which can be repeatedly used to deliver multiple forms of malware to victims.
Specifically, threat actors have been found leveraging "msiexec.exe" to launch "AllMyBasic.msi," which then executes "SiemensSoftwareCenter.exe." The activity has been attributed to a ClickFix delivery platform called Romulus , which was detailed by Forescout last week as being used to deliver Legion Loader and other malware using DLL sideloading.
Technical details
The Siemens blog , published on October 19, detailed how attackers are targeting CVE-2026-110936 (CVSS 8.4) to load malicious DLL files into a directory that the Siemens Software Center searches for.
The installer that carried the files, AllMyBasic.msi, was spread outside official channels, and the activity is attributed to the Romulus multi-platform ClickFix campaign.
The panel serves a PowerShell staging script and a trojanized MSI installer carrying a malware loader, and the routes it uses show that “ROMULUS is a reusable delivery backend rather than a single hard-coded malware server,” the researchers wrote.
Response
Existing installations update to the fixed version automatically the next time they launch, and Siemens urges customers to download its software only from official sources.
Besides updating Siemens Software Center to version 4.0.9.8 or later and starting the application to apply the update, organizations are advised to block the IP addresses and domains associated with the malicious activity and look for "SiemensSoftwareCenter.exe" running from "AppData\Local\Programs" and started by "msiexec.exe."
What security teams should do
On 17 October, it updated the advisory to tell customers that version 4.0.9.8 resolves the issue, and a blog post warning about active exploitation followed on 19 October.
Customers should also look out for the following indications that their PC is affected by the campaign: If a PC has been found to be compromised, customers should isolate the device, stop the process first, then remove the start-up entry and task and reset passwords.
Attribution
Help Net Security: Siemens has confirmed the active exploitation of CVE-2026-110936, a DLL side-loading vulnerability in Siemens Software Center, the company’s tool for downloading, installing and managing its software.
Infosecurity Magazine: The company has attributed the activity to the Romulus multi-platform ClickFix campaign.
The Hacker News: Siemens has addressed a DLL sideloading vulnerability impacting Siemens Software Center that it said has been exploited in ClickFix attacks.
What to watch next
Watch for new exploitation reports and updated indicators of compromise.
Watch for updated vendor guidance and fixed-version details.