Siemens Software Center DLL Vulnerability Exploited in ClickFix Campaign
Summary
Attackers exploited a Siemens Software Center DLL-loading flaw in a ClickFix campaign. Siemens released version 4.0.9.8 to fix it and says the malicious package did not come through its distribution channels.
Key points
- CVE-2026-110936 lets an authenticated local attacker place a malicious DLL where Siemens Software Center will load it, executing code with the program’s privileges.
- Siemens disclosed the vulnerability on October 15 and later fixed it in version 4.0.9.8; installed copies receive the update automatically when launched.
- Attackers paired a legitimate, signed Siemens program with malicious DLLs. Siemens said its software was not tampered with and its distribution channels were not used.
- Siemens links the activity to the Romulus ClickFix operation, which uses fake prompts to persuade users to run malicious commands.
- Siemens recommends monitoring suspicious behavior and malware-associated folders rather than relying only on file hashes, since the abused Siemens executable is legitimate.
- Siemens is sharing threat intelligence with authorities and EDR providers; its blog post includes indicators of compromise and infection signs.
Article Details
- Vulnerability Types
- DLL search-order hijacking caused by improper restriction of DLL search locations
- Severity
- CVSS v4 score: 8.4
- Affected Versions
- Siemens Software Center 3.5.8.7
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
CVE
People
Malware
Vendors
CanonIn those attacks, signed programs from Canon and later Stardock were abused to side-load malicious code that ultimately deployed a RAT.SiemensSiemens revealed on Monday that threat actors have exploited a vulnerability in Siemens Software Center as part of a malware campaign.StardockForescout saw the platform deliver the LegionLoader malware, as well as a trojanized installer that leveraged a legitimate Stardock application for DLL side-loading.