Siemens patches Software Center flaw exploited in attacks

Siemens disclosed on October 19 that a vulnerability in Siemens Software Center, tracked as CVE-2026-110936, has been exploited in real attacks. The company rated the flaw 8.4 under CVSS 4.0 and released version 4.0.9.8 of the program to fix it, according to dailysecu.com.

According to Siemens, attackers placed a legitimately digitally signed Siemens executable together with a malicious DLL in the same folder, achieving DLL side-loading. Siemens published indicators of compromise that include the malicious DLL archive.dll and the malicious installer AllMyBasic.msi.

Siemens said it found no evidence that its own systems or its official software distribution and update channels were compromised. The fix is applied automatically when existing users run the program.

Romulus campaign

The campaign was linked to a ClickFix malware distribution operation called Romulus. Forescout found attack infrastructure matching the malicious distribution server confirmed by Siemens and observed distribution of malware including LegionLoader.

In earlier ClickFix-related cases, Huntress disclosed DLL side-loading that used legitimately signed Canon and Stardock programs and said it responded to at least 40 related attacks.