Siemens has disclosed a critical vulnerability in its Software Center that has been exploited by threat actors in a recent malware campaign. The Software Center, which manages the download, installation, and updating of Siemens software, was compromised due to a flaw identified as CVE-2026-110936. This vulnerability arises from the program's failure to properly restrict the locations it searches for DLL files. An authenticated local attacker could exploit this by placing a malicious DLL in one of these folders, allowing their code to execute with the same privileges as the Software Center.
Siemens shared this vulnerability in a security advisory on October 15, assigning it a CVSS v4 score of 8.4, and subsequently released a patch in version 4.0.9.8 to address the issue. Users will automatically receive this update upon launching the software. Initially, there was no mention of real-world exploitation until Siemens updated their advisory with details of the ongoing attacks. In these incidents, attackers used a legitimate, digitally signed version of the Siemens Software Center in conjunction with malicious DLLs. These files were loaded when the program was executed, bypassing validation checks.
Siemens has reassured customers that their software was not tampered with and no internal distribution channels were breached. Instead, the attackers distributed the malware independently. Siemens is actively sharing intelligence with authorities and endpoint detection and response providers, offering indicators of compromise for detection purposes. The company advises focusing on suspicious activity rather than file hashes, due to the legitimate nature of the Siemens file used in the attacks.
The malware campaign has been linked to the Romulus platform, which employs ClickFix attacks. These attacks involve fake prompts that lead users to execute harmful commands. Research by Forescout and Huntress has revealed that Romulus can deploy various malware payloads and has been used in multiple campaigns. While Siemens Software Center is not directly named in these reports, the infrastructure and methods suggest it has been integrated into the same malicious toolkit.
