Siemens has officially confirmed that threat actors have been actively exploiting a security vulnerability within the Siemens Software Center, a critical utility used by customers to manage software installations, updates, and licensing. The company revealed on Monday that the flaw, which allows for unauthorized code execution, has been integrated into the ongoing “Romulus” campaign—a sophisticated, multi-platform operation that utilizes “ClickFix” social engineering tactics to compromise systems.
The vulnerability, formally tracked as CVE-2026-110936, stems from a flaw in how the Siemens Software Center handles the loading of Dynamic Link Library (DLL) files. Specifically, the application failed to sufficiently restrict the file paths it searched for necessary DLLs, creating a prime opportunity for attackers to engage in DLL side-loading. By planting a malicious DLL file in one of the directories scanned by the software, an authenticated local attacker could trick the application into executing arbitrary code with the same high-level privileges held by the Siemens Software Center itself.
Disclosure and Remediation
The technical details of the vulnerability were first disclosed by Siemens on October 15. The company initially assigned the flaw a CVSS v4 score of 8.4, reflecting the significant risk it posed to the integrity of the host system. Two days later, on October 17, Siemens updated its security advisory to confirm that a patch had been developed and released. Version 4.0.9.8 of the Siemens Software Center addresses the insecure loading behavior, effectively neutralizing the attack vector.
For existing users, the remediation process is designed to be seamless. The application is configured to receive and apply the fix automatically upon its next launch, ensuring that customers are protected without requiring manual intervention. While the initial advisory provided the necessary technical disclosures, it was not until Monday that Siemens explicitly addressed the fact that this vulnerability was already being actively exploited in the wild. The company simultaneously published a detailed blog post outlining the nature of these attacks, the indicators of compromise (IoCs), and strategies for defenders to identify potentially infected machines.
The Mechanics of the Attack
The exploitation of CVE-2026-110936 is a stark reminder of the dangers posed by legitimate software being used as a Trojan horse. In these attacks, the threat actors did not attempt to breach Siemens’ own infrastructure, distribution channels, or signing servers. Instead, they paired a perfectly legitimate, digitally signed copy of the Siemens Software Center with their own malicious DLL files.
When the user launched the application, it behaved exactly as programmed, scanning its local folder for the necessary helper files. Because version 3.5.8.7 did not perform rigorous validation of these files, it unknowingly loaded the attacker’s malicious code, providing the intruders with a foothold on the victim’s machine. Siemens has been categorical in its assessment that its own systems were not compromised. "No Siemens system, product or update channel was breached to our knowledge," the company stated, emphasizing that the misuse of its software was entirely external to its internal security controls.
Because the executable file used in the attack carries a valid digital signature from Siemens, traditional security tools that rely solely on file hashes for detection may fail to flag the program as malicious. Consequently, Siemens is urging security teams and EDR (Endpoint Detection and Response) providers to pivot their defensive strategies. Instead of relying on signature-based detection, administrators are advised to focus on identifying suspicious behavioral patterns and monitoring the specific folders associated with the malicious payload. Siemens is currently working closely with authorities and cybersecurity partners to share threat intelligence and refine detection capabilities.
Connection to the Romulus ClickFix Operation
The investigation into these incidents has led Siemens to link the activity to “Romulus,” a persistent and evolving ClickFix delivery platform. ClickFix attacks have become a common weapon in the arsenal of modern cybercriminals. These campaigns typically lure users into a trap by displaying fake prompts—often mimicking a CAPTCHA verification process or a browser update warning—that instruct the user to copy and paste a series of commands into their terminal. Once executed by the victim, these commands initiate the download and installation of various malware payloads.
Recent research published by the security firm Forescout has shed light on the scope of the Romulus platform. Forescout identified several servers hosting the Romulus infrastructure, including the specific server used to distribute the malicious package that contained the Siemens Software Center. The platform is highly versatile, capable of deploying a wide array of threats, including the LegionLoader malware. Furthermore, investigators found evidence that the same platform had been used to deliver trojanized installers for other vendors, including Stardock, using the same DLL side-loading technique now seen with the Siemens software.
The researchers at Forescout were unable to attribute the Romulus platform to a specific group or entity. It remains unclear whether Romulus is a private tool maintained by a single threat actor, a “malware-as-a-service” offering sold to various criminal groups, or a shared codebase that has been independently adopted by multiple attackers.
This is not the first time such tactics have been documented. Late last month, researchers at Huntress detailed a similar campaign that utilized rogue ChatGPT Custom GPTs to lure unsuspecting users into ClickFix pages. In that instance, attackers abused signed programs from Canon and Stardock to facilitate the side-loading of malicious code, eventually deploying Remote Access Trojans (RATs). Huntress reported responding to at least 40 separate incidents linked to that specific campaign, and they have cautioned that many other signed programs from various software vendors are likely being exploited in similar ways.
While the Siemens Software Center was not explicitly named in the earlier reports from Huntress or Forescout, the similarities in infrastructure and the reliance on identical side-loading mechanisms strongly suggest that the Siemens utility has been integrated into the existing Romulus toolkit. The ease with which these attackers can pivot from one legitimate software package to another highlights the persistent challenge posed by legitimate programs being co-opted for malicious purposes.
The discovery of this exploit was credited to security researcher Jose Oregon of Huntress, who reported the vulnerability to Siemens, prompting the rapid development and release of the security patch. As the industry continues to grapple with the rise of ClickFix and the misuse of signed binaries, Siemens’ swift response and collaboration with external security researchers underscore the necessity of robust vulnerability disclosure programs. Customers are strongly encouraged to ensure their Siemens Software Center is updated to version 4.0.9.8 or later and to maintain heightened vigilance for unauthorized or unexpected prompts and processes occurring on their local systems.
