SIEMENS has disclosed and patched a DLL sideloading flaw in its Software Center that has been actively exploited in ClickFix campaigns. Tracked as CVE-2026-110936 (CVSS v4 score: 8.4), the vulnerability arises because the affected application loads DLLs from an uncontrolled search path. An authenticated local attacker could place a crafted DLL in a directory the application searches, leading to arbitrary code execution with the privileges of the Siemens Software Center service. Siemens states the fix is included in version 4.0.9[.]8.
In exploitation observed by researchers, attackers used a genuine, signed copy of Siemens Software Center as a carrier, placing a malicious DLL named archive[.]dll alongside it. They trigger execution via msiexec to launch AllMyBasic[.]msi, which then runs SiemensSoftwareCenter[.]exe. The ClickFix platform Romulus is implicated as the delivery mechanism, with collaboration from other reports noting use of malicious ChatGPT Custom GPTs to direct victims to a fake URL that serves the lure.
Siemens has also shared indicators of compromise, including 96.62.218[.]59, wizardexpensive[.]com, and 2.27.248[.]127 as related hosts or distribution channels.
Practical response advised by Siemens includes updating Software Center to 4.0.9[.]8 or later, starting the application to apply the patch, and network controls such as blocking the associated IPs and domains. Organisations should look for SiemensSoftwareCenter[.]exe running from AppData\Local\Programs and started by msiexec[.]exe to detect potential activity.