"The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path," Siemens said in an advisory.
CVE-2026-110936: a high-severity DLL sideloading flaw in Siemens Software Center
Siemens disclosed and patched a DLL sideloading vulnerability tracked as CVE-2026-110936 (CVSS v4 score: 8.4) in Siemens Software Center. Siemens said the flaw could allow an authenticated local attacker to place a specially crafted DLL in a directory the application searches, "leading to arbitrary code execution with the privileges of the affected application." The issue has been fixed in version 4.0.9.8. Huntress Labs researcher Jose Oregon is credited with discovering and reporting the shortcoming.
How attackers turned a signed, legitimate installer into a carrier
Siemens warned that threat actors abused a genuine, signed copy of Siemens Software Center by placing a crafted DLL named "archive.dll" alongside it to trigger execution of malicious code. According to Siemens, the attackers selected the program "because it is signed and trusted, and because version 3.5.8.7, the latest version at the time, loaded helper files from its own folder without checking them."
In observed campaigns, operators leveraged msiexec.exe to launch an installer named AllMyBasic.msi. That MSI then executed SiemensSoftwareCenter.exe, which — when the malicious DLL was present — resulted in execution of the attacker's code with the application's privileges.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogClickFix, Romulus, Legion Loader and the use of MSI/DLL sideloading chains
Siemens attributed the activity to a ClickFix delivery platform called Romulus. Forescout, in a report last week, detailed Romulus as a delivery vehicle used to drop Legion Loader and other malware via DLL sideloading. Huntress Labs reported that some ClickFix campaigns combined this technique with social-engineering playbooks: malicious ChatGPT Custom GPTs were used to direct victims to a fake URL hosting a ClickFix lure. When victims copied and executed the lure, PowerShell code ran to drop an MSI installer that abused DLL sideloading and ultimately deployed a remote access trojan (RAT).
Indicators of compromise and Siemens' mitigation steps
Siemens published specific indicators and remediation guidance. The company recommended updating Siemens Software Center to version 4.0.9.8 or later and starting the application so the update takes effect. Siemens also advised blocking the IP addresses and domains associated with the activity and scanning for telltale process relationships.
- Indicators of compromise shared by Siemens:
- 96.62.218[.]59 (payload hosting and command-and-control)
- wizardexpensive[.]com (payload hosting and command-and-control)
- 2.27.248[.]127 (distribution channel of AllMyBasic.msi)
- Detection recommendations: look for "SiemensSoftwareCenter.exe" running from "AppData\Local\Programs" and started by "msiexec.exe."
- Remediation: update to Siemens Software Center 4.0.9.8 or later and launch the application to apply the patch.
What this means for technologists, affected enterprises, and end users
Technologists and security teams should prioritize patching Siemens Software Center to 4.0.9.8 or later, block the listed IPs and domain, and hunt for msiexec.exe → AllMyBasic.msi → SiemensSoftwareCenter.exe chains, especially when SiemensSoftwareCenter.exe is running from AppData\Local\Programs.
Affected enterprises and procurement leaders must note that attackers chose a signed, trusted program as a carrier; they should review deployment and update practices for signed third‑party installers and validate helper-file loading behavior in managed applications.
End users should be wary of unexpected copy-and-paste instructions, downloads or links prompted by chat-based assistants; Huntress reported that malicious ChatGPT Custom GPTs were used in some campaigns to deliver the lure that ultimately dropped the MSI.
Siemens has issued a patch and provided indicators for blocking and detection. Still, the attack chain described — a signed, trusted binary launched through an MSI executed by msiexec.exe combined with DLL sideloading — underscores how adversaries can leverage legitimate software and social engineering together. Organizations that use Siemens Software Center should update immediately and search for the specific process behaviors Siemens highlighted; the remaining question is how many deployments will still be running the vulnerable 3.5.8.7 behavior that allowed helper files to be loaded from the application's folder without checking them.
Original reporting: https://thehackernews.com/2026/10/clickfix-attackers-exploit-siemens.html
