Siemens Patches Software Center DLL Flaw After ClickFix Gangs Used It to Plant a Remote Access Trojan

Siemens has released a fix for a high-severity weakness in Siemens Software Center, tracked as CVE-2026-110936. The company says criminals have already abused the flaw. Attackers took a genuine, digitally signed copy of the program and used it to load their own malicious code. They used this trick in "ClickFix" campaigns that ended with a remote access trojan on victims' computers. Siemens described the problem in a security advisory and a separate threat alert. Huntress Labs researcher Jose Oregon is credited with finding and reporting the bug.

What happened

Siemens issued two related notices. The first is a standard security advisory. It describes a DLL sideloading vulnerability in Siemens Software Center and announces a fix in version 4.0.9.8. The second is a separate alert explaining how attackers misused the software in real attacks.

Siemens says the attackers did not need to break into a Siemens system or tamper with the program itself. They took a legitimate copy of Siemens Software Center that still carried a valid digital signature. Then they placed a crafted file named archive.dll in the same folder. When the trusted program started, it loaded that file, and the attackers' code ran.

Siemens explained why the attackers picked this program. It was signed and trusted, and version 3.5.8.7, the newest release at the time, "loaded helper files from its own folder without checking them," the company said.

According to Siemens, the observed attack chain started with Windows' built-in installer tool, msiexec.exe. That tool ran an installer package called AllMyBasic.msi, which in turn launched SiemensSoftwareCenter.exe. The activity has been linked to a ClickFix delivery platform called Romulus. Forescout described Romulus the week before. It said the platform was being used to distribute Legion Loader and other malware through DLL sideloading.

Huntress added detail about how victims were lured. Some campaigns used malicious ChatGPT Custom GPTs, which are user-built versions of the chatbot. These pointed people to a fake web address hosting a ClickFix lure. Victims who copied and ran the supplied command launched PowerShell code. That code dropped an MSI installer, which used DLL sideloading to install a remote access trojan.

Who is affected

According to the vulnerability description in the NVD/CISA data, the flaw affects Siemens Software Center, all versions before V4.0.9.8. The version that attackers abused in the wild was 3.5.8.7.

The sources do not name specific industries, countries or organisation types targeted by the campaigns. They also do not estimate how many systems run vulnerable versions.

Anyone can be exposed to ClickFix lures, because the technique relies on persuading a person to run a command. The Siemens software in this case served as a trusted "carrier" for the malware. A victim did not need to have Siemens Software Center installed already, because the attackers brought their own copy.

How it works

Some background helps here. A DLL (dynamic-link library) is a file of shared code that Windows programs load while they run. When a program asks for a DLL by name, Windows searches several locations for it. The program's own folder is often one of the first places checked.

DLL sideloading abuses this search order. If a program does not control where it loads libraries from, an attacker can put a fake DLL with the expected name somewhere the program looks first. The program then runs the attacker's code as if it were its own. The CVE data classifies this weakness as CWE-427, "Uncontrolled Search Path Element."

The danger grows when the program is digitally signed by a known vendor. Security tools and users tend to trust signed software. Malicious code running inside a signed Siemens process may therefore attract less suspicion than an unknown program. Siemens' advisory says the injected code runs with the same privileges as the affected application.

ClickFix is the social engineering part of the attack. Victims see a fake prompt, such as a bogus error or verification step. It tells them to copy a command and paste it into a Windows tool so they run it themselves. Because the victim launches the command, some defences that block malicious downloads can be bypassed. A remote access trojan is malware that gives attackers ongoing remote control of an infected computer.

How serious is it?

The flaw carries a CVSS v4 score of 8.4, rated High. The ITVedas CVE database, drawn from NVD and CISA, confirms this. According to the official description, exploiting the bug requires an authenticated local attacker. In other words, the attacker must already be able to put files on the machine. That limits the bug as a standalone way in. ClickFix fills that gap by getting the victim to run the attacker's commands.

On exploitation, the sources differ in a way worth noting. Siemens says the weakness has been abused in real ClickFix attacks. However, the CVE data shows the flaw is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalogue. This does not mean the attacks did not happen. It means CISA had not added this CVE to its official list when our data was retrieved.

The real-world abuse, the trusted signature, and the link to an established malware delivery platform all make this a flaw to take seriously.

What to do now

For administrators and security teams:

• Update Siemens Software Center to version 4.0.9.8 or later. Siemens notes the application must be started for the update to apply.
• Block the indicators of compromise Siemens shared:
  • 96.62.218[.]59 (payload hosting and command-and-control)
  • wizardexpensive[.]com (payload hosting and command-and-control)
  • 2.27.248[.]127 (distribution point for AllMyBasic.msi)
• Hunt for SiemensSoftwareCenter.exe running from an AppData\Local\Programs folder with msiexec.exe as its parent process. Siemens flags this pattern as suspicious.
• Check for a file named archive.dll sitting next to copies of the Siemens program in unexpected places.
• Do not treat a valid code signature as proof that a running process is safe. Watch for signed programs launched from user profile folders.
• Remind staff about ClickFix-style lures, including those delivered through AI chatbot tools.

For everyday users:

• Never copy and paste commands from a website, pop-up or chatbot into PowerShell, the Run box or a terminal unless you fully understand them.
• Be wary of any "fix" or "verification" step that asks you to run commands yourself.
• If you use Siemens Software Center, make sure it is updated to 4.0.9.8 or newer.
• If you think you ran a suspicious command, disconnect from the network and contact your IT or security team.

What we still don't know

• The sources do not name the specific remote access trojan delivered in these campaigns.
• No figures on the number of victims, or the sectors and regions hit, have been shared.
• It is unclear whether CISA will add CVE-2026-110936 to its KEV catalogue, given Siemens' confirmation of abuse.
• The sources do not say whether attackers abused other signed applications alongside Siemens Software Center in the Romulus campaigns.
• Who operates the Romulus platform, and how the malicious Custom GPTs were created and spread, remains unexplained.

ITVedas analysis: This case shows that an ordinary loading flaw in a trusted, signed program can become a tool for criminals. They did not need to breach the vendor; they only needed its signature. Patching closes this particular gap. Defenders should still focus on the underlying pattern: a signed binary running from an unusual folder, launched by an installer the user never meant to run.