Science & Tech · Cybersecurity · 1 hr ago
Attackers exploit Siemens Software Center flaw to spread malware
Attackers are exploiting a flaw in Siemens Software Center to run malware on customers’ computers.
Siemens says the activity is part of Romulus, a campaign using ClickFix tricks to persuade people to run commands themselves.
The flaw let an older version of the program load malicious helper files placed beside a genuine, digitally signed copy.
The malicious installer was distributed outside Siemens’ official channels, and the company says its systems and software were not breached.
ClickFix lures can imitate security checks and ask users to paste commands into tools such as PowerShell, so Siemens warns never to do this.
Siemens fixed the flaw in version 4.0.9.8, which existing installations receive when the program next starts.
Customers should use only official Siemens downloads and, if they suspect infection, isolate the computer, remove malicious start-up entries and reset passwords.
Siemens says attackers are actively exploiting a DLL side-loading flaw in Software Center to deliver malware through a ClickFix campaign.
The vulnerability, CVE-2026-110936, affects versions including 3.5.8.7 and is fixed in version 4.0.9.8.
Attackers used a genuine, digitally signed copy of Siemens Software Center alongside malicious files, distributed in an installer outside official Siemens channels.
Siemens attributed the activity to the Romulus multi-platform ClickFix campaign, while Forescout said the platform’s operator remains unknown.
Siemens says no company system, product or update channel was breached to its knowledge and advises customers to update and download software only from official sources.
- Who
- Attackers attributed by Siemens to the Romulus multi-platform ClickFix campaign.
- What
- They exploited a DLL side-loading flaw in Siemens Software Center to deliver malware.
- When
- Siemens disclosed the flaw on 15 October 2026 and reported active exploitation on 19 October.
- Where
- The attack targeted users’ devices; the installer was distributed outside official Siemens channels.
- Why
- Not stated
This story does not have two clearly opposing sides.
Siemens published a security advisory for CVE-2026-110936.
Siemens updated its advisory to say version 4.0.9.8 resolves the vulnerability.
Siemens published a blog post warning that the flaw was being actively exploited.
Multiple outlets reported the campaign and Siemens’ advice to customers.
- Vulnerability
- CVE-2026-110936
- Severity
- CVSS v4.0 score of 8.4
- Fixed version
- Siemens Software Center 4.0.9.8
- Affected version cited
- Siemens Software Center 3.5.8.7
- Malicious installer
- AllMyBasic.msi
- Distribution IP
- 2.27.248[.]127
4 sources
Attackers exploit Siemens Software Center flaw in active ClickFix malware campaign
Siemens Customers Targeted by ClickFix Attackers Exploiting DLL Side-Loading Flaw
ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan
Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks
What people are saying
No Siemens system, product or update channel was breached to our knowledge. EDR vendors and authorities have been engaged for intelligence sharing, enabling broader detection coverage and coordinated defensive actions
Never paste a command from a web page into Win+R, the Run box or PowerShell. A real ‘I am not a robot’ check never asks for this
The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path