Siemens Patches Software Center DLL Sideloading Flaw Exploited in ClickFix Attacks

Summary

Siemens patched a high-severity DLL sideloading flaw in Software Center that it says was exploited in ClickFix attacks to deploy a remote access trojan. Version 4.0.9.8 or later fixes the issue.

Key points

CVE-2026-110936 (CVSS v4 score: 8.4) lets an authenticated local attacker place a crafted DLL in a searched directory, potentially enabling code execution with the affected application’s privileges.
The flaw was fixed in Siemens Software Center version 4.0.9.8; Huntress Labs researcher Jose Oregon discovered and reported it.
Siemens said attackers used a genuine, signed copy of Software Center alongside a crafted DLL named archive.dll to trigger malicious code execution.
The reported attack chain used msiexec.exe to launch AllMyBasic.msi, which then executed SiemensSoftwareCenter.exe.
The activity was attributed to Romulus, a ClickFix delivery platform previously reported by Forescout as distributing Legion Loader and other malware through DLL sideloading.
Huntress said some campaigns used malicious ChatGPT Custom GPTs to direct victims to a fake URL; the ClickFix lure prompted victims to copy and execute PowerShell code that dropped an MSI installer.
Siemens advised updating to version 4.0.9.8 or later, blocking associated malicious IP addresses and domains, and checking for SiemensSoftwareCenter.exe running from AppData\Local\Programs and launched by msiexec.exe.