HIGH: Siemens Software Center CVE-2026-110936 Exploited in ClickFix Attacks

Every few months the industry rediscovers that a digital signature tells you who built a program, not whether it is safe to run in the folder someone dropped it into. This week Siemens got its turn in that spotlight. The company has confirmed that attackers are abusing a genuine, validly signed copy of Siemens Software Center to sideload malware onto Windows machines, and the delivery mechanism is ClickFix, the social engineering trick that has quietly become one of the most dependable ways into a corporate network in 2026.

The flaw is tracked as CVE-2026-110936, and Siemens rates it 8.4 under CVSS v4, which puts it squarely in "this is bad, prioritize it" territory. Third party trackers such as Strix list a CVSS 3.1 score of 6.7, which reflects the local attack vector. Do not let the lower number lull you to sleep. A local vector stops mattering much once the attackers have figured out how to get the user to do the local part for them, and that is exactly what is happening here.

What Siemens Disclosed

Siemens Software Center is the utility engineers and designers use to download, install, activate, and update Siemens software such as Solid Edge, and it can also kick off free trials. In advisory SSA-580366, published October 15, 2026, Siemens explained that the application "loads dynamic-link libraries (DLLs) from an uncontrolled search path." In plain English, when the program starts it goes looking for helper libraries and happily loads whatever it finds sitting in its own folder, without checking whether those files actually came from Siemens. An authenticated local attacker who can place a crafted DLL in one of those search locations gets code execution with the privileges of the Software Center process.

Version 3.5.8.7, the newest release at the time of disclosure, was confirmed vulnerable. Two days after the original advisory, Siemens updated it to say that version 4.0.9.8 fixes the issue. Existing installations pick up the fix automatically the next time the application is launched, which is convenient until you remember how many of these utilities get installed once and never opened again.

Then on Monday, October 19, Siemens followed up with the part nobody wants to read. The vulnerability is being exploited in the wild. The flaw was reported by Jose Oregon of Huntress Labs, and Siemens went out of its way to stress that its own infrastructure was not compromised. "No Siemens system, product or update channel was breached to our knowledge," the company said. That is good news for Siemens and does very little for anyone whose workstation just ran the attacker's DLL.

How the Attack Chain Works

This is not a case of attackers hunting down machines that already have Siemens Software Center installed. They bring their own copy. The attackers bundle the legitimate, signed SiemensSoftwareCenter.exe together with a malicious library named archive.dll and wrap the whole thing in an MSI installer called AllMyBasic.msi. Because the executable is signed and unmodified, it sails past a lot of reputation checks and application allowlists that trust the publisher rather than the behavior.

The front end is classic ClickFix. A victim lands on a fake page, often dressed up as a CAPTCHA check or a bogus error fix, and is told to paste a command into the Run dialog or a PowerShell window to continue. Huntress has documented campaigns where malicious ChatGPT Custom GPTs pointed users toward these lure pages, which is a delightfully modern way of saying that people are now being socially engineered by a chatbot that was itself socially engineered. Once the user runs the pasted command, PowerShell reaches out, pulls down the MSI, and hands it to msiexec.exe. The installer drops the bundle under the user profile and launches SiemensSoftwareCenter.exe, which dutifully loads archive.dll from its own folder. At that point the attacker's code is running inside a signed Siemens process, and a remote access trojan is on the box.

Siemens tied the activity to Romulus, the ClickFix delivery platform that Forescout's Vedere Labs detailed last week. Forescout described Romulus as a malware delivery service that serves PowerShell staging scripts which decide what to fetch next, either a trojanized MSI carrying a loader or an encrypted archive containing Legion Loader that has been padded out to nearly a gigabyte to choke sandboxes and upload limits. Legion Loader, which also goes by Satacom, CurlyGate, and RobotDropper, then pulls whatever the operator wants to run next. One of the distribution servers Siemens flagged, 2.27.248[.]127, appears in Forescout's list of Romulus hosts, and that overlap is what links the two investigations.

It is also worth noting that Siemens is not the only vendor whose signed binaries are being borrowed. Huntress reported in late September that a related campaign abused signed Canon and Stardock programs in the same way, and the firm says it has responded to at least 40 incidents linked to that activity. Forescout separately observed Romulus sideloading through a legitimate Stardock application. The pattern is clear. Attackers are building a library of signed executables with sloppy DLL loading and rotating through them as each one gets burned. Siemens Software Center is simply the latest entry in that catalog.

Who Is Actually at Risk

Here is the uncomfortable part for defenders. You do not need to be a Siemens customer to be hit by this. Because the attackers ship their own copy of the vulnerable executable, any Windows user who can be talked into pasting a command is a potential victim. Manufacturing and engineering shops that run Siemens tooling have an extra wrinkle, since a SiemensSoftwareCenter.exe process looks perfectly normal on their workstations and may not draw a second glance from an analyst. Everyone else should treat the sudden appearance of that executable on a marketing laptop or an accounting desktop as a big red flag.

Patching your own legitimate installs to 4.0.9.8 is still important, because it closes the door on local abuse of copies you already have. Just understand that patching does not stop an attacker from bringing an old, vulnerable copy along with them. That is the nature of a bring your own vulnerable binary attack, and it is why behavior based detection matters more here than version numbers.

What to Do Now

Start with the housekeeping. Update every legitimate Siemens Software Center installation to version 4.0.9.8 or later, and actually open the application on each machine so the automatic update applies. If you manage engineering workstations, push the update through your software deployment tool rather than trusting users to launch a utility they forgot they had.

Next, block the infrastructure Siemens published. The company identified 96.62.218[.]59 and wizardexpensive[.]com as payload hosting and command and control, and 2.27.248[.]127 as the server distributing AllMyBasic.msi. Forescout's other Romulus hosts, including 96.62.224[.]81, 86.109.75[.]7, 151.240.151[.]223, 23.94.145[.]224, and 93.152.224[.]118, are worth adding to your blocklists while you are at it.

Then go hunting. Siemens recommends focusing on behavior rather than file hashes, since the executable is genuine and signed. Look for SiemensSoftwareCenter.exe running out of AppData\Local\Programs, particularly when its parent process is msiexec.exe. Flag any instance of archive.dll loading into that process from a user writable path. Review PowerShell logs and the RunMRU registry key for pasted one liners that download and execute content, since that is the ClickFix fingerprint. If you have script block logging and EDR telemetry, a query that correlates explorer.exe or the Run dialog spawning PowerShell, followed shortly by msiexec.exe, followed by a signed vendor binary loading an unsigned DLL from the same folder, will catch this campaign and its Canon and Stardock cousins too.

Finally, look at the control that would have stopped all of this before it started. Plenty of organizations can disable the Win+R Run dialog for standard users through Group Policy, restrict PowerShell to Constrained Language Mode, and use application control rules that consider file path and behavior rather than blanket trust in a publisher certificate. None of those are glamorous, but they turn ClickFix from a reliable entry point back into a mild annoyance. And yes, user awareness training should now include a slide that says, in large letters, that no legitimate CAPTCHA will ever ask you to open PowerShell.

The Bigger Picture

DLL sideloading is not new. It has been a staple of APT tradecraft for over a decade. What has changed is the delivery. ClickFix removes the need for an exploit or a malicious attachment because the victim runs the command themselves, and signed vulnerable binaries remove the need for a code signing certificate because someone else already paid for one. Put those together and you get an attack chain that costs almost nothing to run and slips past the controls many shops still rely on. Siemens handled the disclosure responsibly and shipped a fix quickly, but the real lesson here is about how we decide what to trust. A signature is a statement of origin, not a statement of safety.

MSP Angle

ClickFix campaigns abusing signed binaries are a great conversation opener for clients who think antivirus plus a firewall is enough. Pitch a managed EDR and threat hunting package that specifically watches for signed process sideloading, and bundle it with a quick Group Policy hardening engagement and refreshed phishing training that covers paste and run lures.