SIEMENS confirms that CVE-2026-110936, a DLL sideloading flaw in Siemens Software Center, is being exploited in the wild. The vulnerability allows attackers to load malicious DLLs through an uncontrolled search path, disguising malware as a legitimate, signed Siemens process. In the current ClickFix campaign, criminals bundle a genuine Software Center installer with their own malicious DLLs, so the host process appears trusted.
Siemens notes that the exploitation relies on unmodified signed software, complicating detection, and stresses that no Siemens systems, products or update channels were breached on its side. The CVSS scores cited are 6.7 (v3.1) and 8.4 (v4.0), with an overall high severity, and the exploitation notice has been linked to Romulus/ClickFix activity. Evidence also points to a distribution server within Romulus infrastructure, as reported by Forescout and SecurityWeek; CISA has not yet added the flaw to KEV.
Affected products and remediation details are explicit: Siemens Software Center versions prior to 4.0.9[.]8 are vulnerable, including 3.5.8[.]7. Siemens has issued a patch in 4.0.9[.]8 and recommends updating to 4.0.9[.]8 or later.
Practical mitigations include downloading software only from official Siemens sources, monitoring for SiemensSoftwareCenter[.]exe running from AppData\\Local\\Programs after an msiexec launch, and blocking known malicious hosts such as 96.62.218.[0-9], wizardexpensive.[0-9], and 2.27.248.[0-9]. Organisations should prioritise detection by monitoring folders and behaviour, not the signed file itself.