SIEMENS has warned customers that attackers are actively exploiting a dynamic link library (DLL) side-loading flaw in its Software Center to distribute malware. The activity is linked to the Romulus multi-platform ClickFix campaign, a server hosting panel identified by Forescout researchers on 14 October, which allows cybercriminals to deploy ClickFix tactics across an ecosystem and repeatedly deliver various forms of malware to victims. ClickFix relies on social engineering to persuade victims to run attacker-supplied commands on their machines.
The vulnerability exploited is CVE-2026-110936 (CVSS 8.4), with attackers loading malicious DLLs into a directory scanned by Software Center and using a genuine application with a valid signature to host their files next to it. Siemens notes that Version 3.5.8[.]7 of Software Center loaded helper files from its own folder without validation. If victims execute the ClickFix commands, the resulting malware runs with the privileges of the affected application.
In response, Siemens urges Software Center users to upgrade to version 4.0.9[.]8 (updates auto-apply on next start) and to watch for indicators such as unexpected start-up entries, a SM Software Provisioning Service folder in AppData Local Programs, files named activate[.]bak or statinfosta[.]DB beside SiemensSoftwareCenter[.]exe, an FTSuite folder with ftc[.]uml in AppData Local, and connections to 96.62.218[.]59.
If compromised, isolate and terminate the process, remove startup items, and reset passwords; only download Siemens software from official sources and block the listed IP/domain.