Siemens has officially confirmed that threat actors are actively exploiting a critical vulnerability within the Siemens Software Center, a utility widely used by customers to manage software installations, activations, and updates. The disclosure, which arrived on Monday, highlights the increasing sophistication of modern malware campaigns that leverage legitimate, digitally signed software to bypass security controls and facilitate unauthorized code execution.
The vulnerability, tracked as CVE-2026-110936, stems from a flaw in how the Siemens Software Center handles the search and loading of Dynamic Link Library (DLL) files. By failing to properly restrict the directories from which these essential components are loaded, the application inadvertently creates an opportunity for attackers to plant malicious files. If an authenticated local attacker successfully places a malicious DLL in one of these search-path locations, the software will load the unauthorized code, granting the attacker the same system privileges held by the Software Center application itself.
The severity of the flaw is reflected in its CVSS v4 score of 8.4, signaling a high-risk security gap that requires immediate attention from system administrators and end-users alike. Siemens first brought the vulnerability to public attention on October 15 through a formal security advisory. Recognizing the urgency of the situation, the company moved quickly to release a patch, updating the advisory just two days later to confirm that version 4.0.9.8 successfully remediates the DLL search path issue. For users already running the Siemens Software Center, the update process is designed to be seamless; the fix is delivered automatically upon the next launch of the application.
Understanding the Attack Vector: The DLL Side-Loading Strategy
While the advisory initially focused on the technical nature of the flaw, Monday’s update underscored a more concerning reality: the vulnerability is being actively exploited in the wild. Siemens supplemented its advisory with a dedicated blog post detailing the nature of the attacks, providing a clear picture of how threat actors have weaponized this oversight.
In these campaigns, attackers utilize a "side-loading" technique. They combine a legitimate, digitally signed copy of the Siemens software with their own malicious DLL files. When the unsuspecting user executes the program, the software inadvertently loads the attacker-supplied libraries from its local folder rather than pulling the intended, authentic files. Because the primary executable carries a valid digital signature from Siemens, traditional security tools—which often trust signed software by default—frequently fail to flag the process as malicious.
Importantly, Siemens has been quick to clarify that its own internal systems and distribution channels have remained secure. The company emphasized that its software was not tampered with at the source, and the malicious bundles were distributed entirely outside of Siemens’ official ecosystems. "No Siemens system, product or update channel was breached to our knowledge," the company stated, seeking to reassure customers that this was not a supply-chain attack on their infrastructure, but rather a manipulation of the software’s local behavior by external actors.
To combat this, Siemens is working closely with law enforcement and endpoint detection and response (EDR) providers. The company has shared comprehensive threat intelligence, including specific Indicators of Compromise (IoCs) and behavioral markers that might suggest an infection. Because the Siemens executable involved in the attacks is legitimate, the company has advised security teams to pivot away from simple file-hash detection. Instead, defenders should focus on monitoring for suspicious process behaviors and scrutinizing the specific directories associated with the malicious payload. The discovery and reporting of this flaw have been credited to Jose Oregon, a researcher at the security firm Huntress.
Links to the Romulus ClickFix Operation
The investigation into these attacks has led Siemens to link the activity to "Romulus," a sprawling, multi-platform campaign centered on the "ClickFix" methodology. ClickFix attacks are characterized by their use of social engineering, often manifesting as fake prompts or bogus CAPTCHA challenges that trick users into copying and executing malicious commands directly into their own systems.
The connection to Romulus was further solidified by research published recently by Forescout, which identified the infrastructure serving as the delivery platform for these malicious bundles. Forescout’s analysis found the Romulus platform operating across multiple servers, including the specific server identified by Siemens as the origin point for the malicious Siemens Software Center packages.
The reach of the Romulus campaign is significant. Forescout researchers observed the platform delivering a variety of payloads, including the LegionLoader malware. In another instance, the platform utilized a trojanized installer that employed a legitimate Stardock application to achieve the same DLL side-loading effect observed in the Siemens incidents. While the identity of the operators behind Romulus remains a subject of ongoing investigation, experts believe it may be a service sold on the dark web, a private toolkit, or a template-based platform being leveraged by various threat actors to deploy their own malicious code.
The pattern of abusing legitimate, signed applications to facilitate attacks has become a hallmark of recent cyber-campaigns. Huntress, which has been tracking similar threats, reported on a campaign in late September that used rogue ChatGPT Custom GPTs to lure users into interacting with ClickFix pages. In that specific operation, attackers similarly abused signed programs from companies like Canon and Stardock to deploy Remote Access Trojans (RATs). Huntress researchers documented at least 40 separate incidents linked to that campaign and noted their belief that other vendors’ signed programs are likely being misused in the same fashion.
While the Siemens Software Center was not mentioned in the earlier reports from Huntress or Forescout, the architectural similarities in the attack—specifically the reliance on the side-loading of DLLs—strongly suggest that the Siemens application was simply the latest tool added to the Romulus arsenal. The overlapping infrastructure and the consistent methodology underscore a broader trend: as security vendors harden their systems against traditional malware, attackers are increasingly turning to the subversion of trusted software to maintain their foothold.
For organizations relying on Siemens software, the guidance remains clear: ensure that the Siemens Software Center is updated to the latest version (4.0.9.8 or higher) and remain vigilant for anomalous activity. By moving away from static detection methods and focusing on the behavioral anomalies described in Siemens’ threat intelligence, security teams can better insulate their environments from the ongoing risks posed by the Romulus campaign and similar threats. As investigations continue, the security community remains focused on dismantling the infrastructure that supports these ClickFix operations, which continue to exploit human psychology and the inherent trust placed in signed software.
