Siemens patches Software Center flaw abused in ClickFix attacks
Siemens says attackers used a signed Software Center installation to load malicious DLLs, and urges users to update to version 4.0.9.8 or later.
Siemens has confirmed active exploitation of a high-severity DLL side-loading vulnerability in Siemens Software Center and says the flaw is being used in ClickFix attacks. The company fixed the issue in Software Center version 4.0.9.8; existing installations update when the application is next started. 12
How the attack works
The vulnerability, tracked as CVE-2026-110936 with a CVSS v4 score of 8.4, allowed a local authenticated attacker to place a crafted DLL in a directory searched by the application. Siemens says the affected version then loaded the file and ran its code with the privileges of the Software Center process. 12
The attackers used a genuine, validly signed copy of Siemens Software Center as the carrier. Siemens says the program itself was not modified: the malicious files were placed next to it, taking advantage of older software that did not check helper files before loading them. 1
Siemens attributes the activity to the Romulus multi-platform ClickFix campaign. The company lists 96.62.218[.]59 and wizardexpensive[.]com as active payload-hosting or command-and-control indicators, while 2.27.248[.]127 was used to distribute the AllMyBasic.msi bundle and is now inactive. 1
What users should do
Siemens recommends updating Software Center to version 4.0.9.8 or later and downloading the client only from official Siemens sources. Defenders should block the listed indicators and look for SiemensSoftwareCenter.exe running from AppData\\Local\\Programs and launched by msiexec.exe. 13
The wider ClickFix pattern matters here: fake verification pages persuade people to paste commands or run installers, after which trusted software can help the malware blend into normal activity. The Hacker News report links this campaign to a broader Romulus operation, while Siemens’ own advisory provides the version and detection guidance. 3
Our opinion
A valid signature is not a guarantee that everything beside a signed executable is safe. Siemens’ response is concrete: update the client, use official download channels, block the indicators and hunt for the unusual process and path combinations. The practical lesson extends beyond this one product—treat “I am not a robot” instructions that ask users to paste commands as an immediate red flag.