Attackers exploit Siemens Software Center flaw in active ClickFix malware campaign

Siemens has confirmed that attackers are actively abusing CVE-2026-110936, a DLL side-loading weakness in Siemens Software Center, the vendor's download and update utility, to smuggle malware onto victims' machines. The advisory, first issued on 15 October 2026 and scored 8.4 under CVSS v4.0 by reporter Jose Oregon of Huntress Labs, was updated two days later to point customers to the patched release 4.0.9.8, followed by a confirmation of in-the-wild abuse on 19 October. Rather than tampering with the signed executable itself, attackers bundled a malicious installer named AllMyBasic.msi that placed rogue helper files next to the trusted, signed program so the older version 3.5.8.7 would load them without verification. The campaign, linked to the Romulus multi-platform ClickFix delivery panel documented by Forescout's Vedere Labs, tricks users into pasting and executing commands themselves, ultimately deploying payloads such as the LegionLoader malware capable of stealing Chrome browser data. Siemens says existing installations will auto-update on next launch and urges customers to only obtain its software from official sources, while defenders are advised to block the identified infrastructure and watch for SiemensSoftwareCenter.exe being spawned by msiexec from AppData\Local\Programs.