Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks

Siemens has confirmed that attackers are actively abusing a flaw in Siemens Software Center, the tool used to download, install, activate and update licensed Siemens software. The bug, CVE-2026-110936 (CVSS v4 8.4), stems from the application failing to restrict where it searches for DLL files, letting an authenticated local attacker plant a malicious library and get it executed with Software Center's privileges. Siemens disclosed the issue on October 15 and later confirmed version 4.0.9.8 fixes it, with existing installs updating automatically on next launch; version 3.5.8.7 was the vulnerable release used in the attacks. The company says attackers bundled a genuinely signed copy of its software with their own malicious DLLs rather than compromising Siemens' own infrastructure, and it has linked the activity to Romulus, a multi-payload ClickFix delivery platform also tied by Forescout and Huntress to malware such as LegionLoader and trojanized Stardock installers used for DLL side-loading.