Siemens has validated active exploitation of CVE-2026-110936, a DLL side-loading vulnerability in Siemens Software Center.
The flaw affects how vulnerable versions locate and load helper DLLs. Siemens said attackers used an unmodified, validly signed copy of the application alongside attacker-supplied files. Version 3.5.8.7, the newest release at the time of the campaign, loaded helper files from its own folder without validating them, according to the company.
Siemens said Software Center version 4.0.9.8 resolves the weakness. Existing installations will update when the application is next started. The vendor previously published advisory SSA-580366 on October 15; its October 19 update added the active-exploitation disclosure.
The campaign is attributed by Siemens to the Romulus multi-platform ClickFix campaign. ClickFix lures typically use fake web prompts to persuade a victim to paste and run a command. SecurityWeek reported that Siemens said the malicious bundle was distributed outside its official channels, and that no Siemens system, product or update channel was known to have been breached.
For detection, Siemens advises defenders not to rely on the signed Software Center file’s hash because the executable used by attackers is genuine. Its guidance instead calls for reviewing suspicious behavior and folders, including SiemensSoftwareCenter.exe running from AppData\Local\Programs after being started by msiexec.
Siemens lists 96.62.218[.]59 and wizardexpensive[.]com as active payload-hosting or command-and-control indicators, and recommends blocking them. It also recommends searching logs for those indicators and 2.27.248[.]127, an inactive distribution channel, because systems that downloaded the bundle before it went offline may remain infected. Organizations finding compromise indicators should isolate the system and follow their incident-response process, Siemens said.