Siemens patches Software Center flaw used in ClickFix campaigns

Siemens has patched a high-severity DLL sideloading vulnerability in Siemens Software Center after attackers exploited the software in ClickFix campaigns to deploy a remote access trojan. The flaw, tracked as CVE-2026-110936, has a CVSS v4 score of 8.4 and is fixed in Siemens Software Center version 4.0.9.8.

Huntress Labs researcher Jose Oregon discovered and reported the issue. Siemens said the application loaded DLLs from an uncontrolled search path, allowing an authenticated local attacker to place a specially crafted DLL in a directory searched by the application. The resulting malicious code could execute with the privileges of the affected service.

Signed software used as a carrier

In the observed activity, attackers used a genuine, validly signed copy of Siemens Software Center alongside a crafted DLL named archive.dll. Siemens said the attackers selected the program because it was trusted and because version 3.5.8.7, then the latest release, loaded helper files from its own folder without checking them.

The execution chain used msiexec.exe to launch AllMyBasic.msi, which then started SiemensSoftwareCenter.exe. The activity has been attributed to Romulus, a ClickFix delivery platform that Forescout detailed as a vehicle for Legion Loader and other malware through DLL sideloading.

ClickFix delivery and detection priorities

Huntress reported that some campaigns used malicious ChatGPT Custom GPTs to guide victims to a fake URL containing a ClickFix lure. When a victim copied and executed the presented content, PowerShell code dropped an MSI installer that abused DLL sideloading before deploying a remote access trojan. The broader pattern aligns with ClickFix delivery chains and trusted binaries where ClickFix chains illustrate how user-guided execution can be combined with trusted binaries.

Siemens published indicators associated with the operation: IP addresses 96.62.218[.]59 and 2.27.248[.]127, plus the domain wizardexpensive[.]com. The first IP address and domain were identified for payload hosting and command-and-control, while the second IP address was identified as a distribution channel for AllMyBasic.msi.

Actions for affected organizations

Organizations should update Siemens Software Center to version 4.0.9.8 or later and start the application so the update can be applied. Siemens also recommends blocking the listed IP addresses and domain, and looking for SiemensSoftwareCenter.exe running from AppData\Local\Programs after being started by msiexec.exe. In practical terms, patching and reviewing that process-parent and path combination should be part of the immediate response for environments that use the product.