Siemens has addressed a DLL sideloading vulnerability impacting Siemens Software Center that it said has been exploited in ClickFix attacks.
The high-severity vulnerability, tracked as CVE-2026-110936 (CVSS v4 score: 8.4), could allow an attacker to place a specially-crafted DLL in a directory the application searches, resulting in execution of malicious code with the same privileges as the affected service.
“The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path,” Siemens said in an advisory. “This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.”
The issue has been patched in version 4.0.9.8. Huntress Labs researcher Jose Oregon has been credited with discovering and reporting the shortcoming.
In a separate alert, Siemens said attackers have abused a genuine copy of Siemens Software Center with a valid signature and placed their own crafted DLL (“archive.dll”) next to it to trigger the execution of malicious code.
“They chose this program as a carrier because it is signed and trusted, and because version 3.5.8.7, the latest version at the time, loaded helper files from its own folder without checking them,” Siemens added.
Specifically, threat actors have been found leveraging “msiexec.exe” to launch “AllMyBasic.msi,” which then executes “SiemensSoftwareCenter.exe.” The activity has been attributed to a ClickFix delivery platform called Romulus, which was detailed by Forescout last week as being used to deliver Legion Loader and other malware using DLL sideloading.
According to Huntress, some of these campaigns have leveraged malicious ChatGPT Custom GPTs to direct victims to a fake URL responsible for serving a ClickFix lure, which when copied and executed by the victim, runs PowerShell code to drop an MSI installer that abuses DLL sideloading to ultimately deploy a remote access trojan.
Siemens has shared the following indicators of compromise –
- 96.62.218[.]59 (Payloading hosting and command-and-control)
- wizardexpensive[.]com (Payloading hosting and command-and-control)
- 2.27.248[.]127 (Distribution channel of AllMyBasic.msi)
Besides updating Siemens Software Center to version 4.0.9.8 or later and starting the application to apply the update, organizations are advised to block the IP addresses and domains associated with the malicious activity and look for “SiemensSoftwareCenter.exe” running from “AppData\Local\Programs” and started by “msiexec.exe.”
