Siemens Software Center Vulnerability Exploited in ClickFix Malware Campaign

• •CVE-2026-110936 is actively exploited, allowing DLL side-loading attacks.
• •Siemens has released an automatic patch for affected users.
• •The attacks are associated with the Romulus ClickFix malware campaign.

Siemens confirmed that a vulnerability in Siemens Software Center (CVE-2026-110936) is being in a malware campaign. The flaw allows authenticated local attackers to execute malicious DLL files due to improper DLL file location restrictions. Siemens released a patch (version 4.0.9.8) on October 15, 2026, which automatically updates existing installations. The attackers used a legitimate version of the software, which was not tampered with, to load their malicious files. Siemens has engaged with EDR vendors and authorities for threat intelligence sharing. The attacks are linked to the Romulus ClickFix operation, which employs fake prompts to trick users into executing malicious commands. Indicators of compromise (IoCs) have been shared to aid detection and response efforts.