SIEMENS SOFTWARE CENTER FLAW EXPLOITED IN CLICKFIX MALWARE ATTACKS ...

X • October 20, 2026

🚨 SIEMENS SOFTWARE CENTER FLAW EXPLOITED IN CLICKFIX MALWARE ATTACKS (CVE-2026-110936)

Siemens ProductCERT has confirmed active exploitation of CVE-2026-110936, a DLL side-loading flaw in Siemens Software Center (CVSS 4.0: 8.4).

• Attackers bundled a genuine, validly signed copy of Siemens Software Center with their own malicious DLLs, which the vulnerable version loaded at startup

• The bundle was spread outside official Siemens channels; Siemens says no Siemens system, product or update channel was breached

• Siemens links the activity to the Romulus multi-platform ClickFix campaign (fake "I am not a robot" prompts that trick users into pasting commands)

• Fix: Software Center V4.0.9.8; existing installs update automatically on start

• Warning signs: Software Center in startup apps/Task Scheduler on a PC that never had it, an "SM Software Provisioning Service" folder under AppData\Local\Programs, or SiemensSoftwareCenter.exe launched by msiexec from AppData

Official vendor confirmation, not a dark-web claim. Because the Siemens binary itself is genuine, hash-based blocking won't catch it. Hunt on folder paths and behavior, block the IoCs in Siemens' post, and never paste commands from a web page into Run or PowerShell.

ClickFix works because nothing looks broken: a fake "prove you're human" box, then a genuine signed Siemens binary loading the bad DLL. Hash allowlists wave it through. Simple office rule: no real captcha ever asks you to press Win+R and paste something. Close the tab.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Active Exploitation of Siemens Software Center Vulnerability in ClickFix Campaign Siemens has confirmed that a DLL side-loading vulnerability (CVE-2026-110936) in Siemens Software Center is actively being exploited in malware attacks. The vulnerability allows attackers to execute malicious code by placing a specially crafted DLL in a directory searched by the application. Siemens first disclosed the flaw on October 15, 2026, assigning it a CVSS v4 score of 8.4. The attackers used a legitimate version of the software, which was not tampered with, to load their malicious files. The malicious activity is linked to the Romulus ClickFix campaign, which tricks users into executing harmful commands. Siemens has released a patch (version 4.0.9.8) to address the issue and is sharing threat intelligence with authorities. Organizations are advised to monitor for suspicious behavior related to the Siemens Software Center. 11 sources 74

Extracted Entities

SIEMENS SOFTWARE CENTER FLAW EXPLOITED IN CLICKFIX MALWARE ATTACKS ...

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Companies (1)

CVEs (1)

Malware (1)

MITRE ATT&CK (1)

Tools (1)