1. Executive summary
Siemens has confirmed in-the-wild exploitation of CVE-2026-110936, a DLL search-path flaw in Siemens Software Center, after attackers paired a legitimate, validly signed copy of the application with attacker-supplied DLLs that the program loaded from its own folder. NVD records the flaw at CVSS 8.4 HIGH (CWE-427, uncontrolled search path); it is not in CISA KEV and EPSS is 0%. Siemens attributes the activity to the Romulus ClickFix operation, but Romulus has no MITRE ATT&CK profile and Forescout, which researched the platform, could not determine who runs it, so the attribution is unconfirmed. The exposure for EMEA financial services is limited to estates running Siemens Software Center below 4.0.9.8, where a user who follows a ClickFix lure can execute attacker code at the application's privilege level. The fix is automatic on next launch, so the priority is confirming the installed version and hunting for side-loaded DLLs in the application folder.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 18 | A cyber threat (Romulus ClickFix delivery of a side-loaded payload via CVE-2026-110936) is now confirmed in the wild against a named product | The threat, not just any incident, feeds the classification process; firms should record it as a known cyber threat in their incident and threat register so detection and escalation thresholds account for it |
| DORA Art. 28 | Exploitation depends on a third-party vendor's software (Siemens Software Center) and its patch cadence | Third-party risk management must cover the vendor's disclosure-to-fix timeline and the auto-update mechanism, not only the contract |
No NIS2 or UK NIS 2018 article is directly engaged by this item on the facts available.
3. Technical analysis & attack chain
The flaw is CWE-427, an uncontrolled search path. Software Center does not properly restrict the locations it searches for DLL files, so an authenticated local attacker can plant a malicious DLL in one of those folders and have it executed with the same privileges as Software Center. Siemens assigned CVSS v4 8.4 and disclosed the flaw on 15 October 2026; the source reports the same 8.4 figure, consistent with the NVD record.
Confirmed steps in the observed attacks:
- Attackers obtained a legitimate copy of Siemens Software Center carrying a valid digital signature. Siemens states its software was not tampered with and the malicious package did not travel through Siemens distribution channels.
- Attackers supplied their own malicious DLL helper files alongside the signed executable.
- When the program started, it loaded the attacker-provided DLLs from its own folder. Siemens states version 3.5.8.7, the newest release at the time, did not validate these helper files before loading them.
- Code executed with the privileges of Software Center.
The delivery vector is ClickFix: fake prompts, such as bogus CAPTCHA checks, that instruct users to paste and execute malicious commands on their own devices. Siemens links the activity to Romulus, a multi-platform ClickFix delivery platform that Forescout found serving several malware payloads, including LegionLoader and a trojanized installer that side-loaded through a legitimate Stardock application. Forescout located the platform on several servers, one of which Siemens identified as the distribution server for the malicious bundle containing its software.
Confidence caveats. The Romulus attribution is Siemens' own and is single-sourced here; Forescout could not determine who runs Romulus and offered several possibilities (a private tool, a service sold to cybercriminals, an affiliate program, or software copied by different actors). Siemens Software Center does not appear in the Huntress or Forescout reports; the link rests on overlapping infrastructure and a similar side-loading approach, so treat "Siemens added to the same toolkit" as an inference, not a confirmed fact. Huntress separately described the Stardock-based package in a late-September report on a campaign using rogue ChatGPT Custom GPTs to lure users to ClickFix pages, abusing signed Canon and later Stardock programs to side-load code that deployed a RAT; Huntress responded to at least 40 incidents and believes other vendors' signed programs are probably being misused too. The specific post-exploitation capability of the Siemens bundle (RAT family, C2, persistence, lateral movement, data access) is not described in the source and is not asserted here.
Defender note from Siemens: because the Siemens executable is legitimate, file-hash detection is unreliable; focus on behaviour and the folders associated with the malware. Siemens is sharing threat intelligence with authorities and EDR providers, and its blog post lists IoCs and infection signs.
4. Mitigation & containment
P1 (within 24h):
- Confirm the installed Siemens Software Center version on every endpoint. Any version below 4.0.9.8 is exposed; 3.5.8.7 is confirmed vulnerable. Launch the application so the automatic update to 4.0.9.8 applies, then re-check the version.
- Hunt for unsigned or unexpected DLLs sitting in the Software Center installation folder alongside the signed executable, and for the application launching from a non-standard path. Siemens directs defenders to the folders associated with the malware.
- Pull Siemens' blog post for its IoC list and infection signs and load them into EDR; treat them as single-sourced until corroborated.
P2 (within 72h):
- Block execution of Software Center from user-writable or download directories via application control; restrict the application to its installed path.
- Add EDR alerts for the signed Software Center binary loading DLLs from its own folder that are unsigned or not on an allowlist.
- Brief service desk and users on ClickFix: no legitimate CAPTCHA or verification step requires pasting a command into Run or PowerShell. Report any such prompt.
P3 (within 7 days):
- Inventory other applications that side-load helper DLLs from their own directory and apply the same folder-integrity monitoring; the Stardock and Canon cases show the pattern is reused across vendors.
- Where Software Center is not business-required, remove it to reduce the side-loading surface.
5. Indicators of compromise
No atomic indicators (hashes, domains, IPs, file paths) are present in the source material. Siemens states its blog post carries the IoCs and infection signs, but those values are not reproduced here. Siemens advises against hash-based detection because the executable is legitimate.
Behavioural indicators:
| behaviour | where to observe | confidence |
|---|---|---|
| Signed Siemens Software Center executable loading unsigned or unexpected DLLs from its own folder | EDR image-load events, Sysmon Event ID 7 | High (Siemens) |
| Software Center version below 4.0.9.8 present on endpoint | Software inventory / file version | High (Siemens) |
| User pasting and running a command from a fake CAPTCHA or verification prompt | PowerShell/Run command-line telemetry, EDR process creation | Medium (ClickFix pattern, single-sourced to Siemens/Forescout) |
6. Detection
Insufficient indicators to author detection rules. The source provides no distinctive strings, filenames, command lines, registry keys, or network artefacts for the Siemens bundle; Siemens withholds the atomic IoCs to its own blog post and recommends behaviour-based detection. Behavioural detection guidance is in §5.
CVE assessment
1 referenced CVE
| CVE | CVSS | Exploited | EPSS | Summary |
|---|---|---|---|---|
| CVE-2026-110936 | 8.4 High | — | 0% | A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynami… |
7. Sources
- SecurityWeek, "Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks", https://www.securityweek.com/siemens-software-center-vulnerability-exploited-in-clickfix-malware-attacks/, 2026-10-19.
- Siemens advisory for CVE-2026-110936 (referenced via SecurityWeek; direct URL not supplied in source), disclosed 2026-10-15, updated 2026-10-17 with fix version 4.0.9.8.
- Forescout research on the Romulus ClickFix platform (referenced via SecurityWeek; direct URL not supplied), week of 2026-10-12.
- Huntress report on rogue ChatGPT Custom GPT ClickFix campaign (referenced via SecurityWeek; direct URL not supplied), late September 2026.
8. Adverse Trace position
Adverse Trace assesses CVE-2026-110936 at CVSS 8.4 HIGH per NVD, not in CISA KEV, EPSS 0%, and treats the Romulus attribution as unconfirmed: Romulus has no MITRE ATT&CK profile and Forescout could not identify its operator, so the Siemens link is an inference from shared infrastructure and side-loading tradecraft. Client impact is bounded by whether Software Center below 4.0.9.8 is installed; where it is, a ClickFix lure can yield code execution at the application's privilege, and the automatic update to 4.0.9.8 closes the flaw on next launch. We will monitor Siemens' blog for the published IoCs, re-check KEV and EPSS status, and update this advisory if corroborated atomic indicators or a confirmed operator emerge. Clients should confirm their Software Center version and report any side-loaded DLL findings to Adverse Trace.
Published via PulseTrace — Adverse Trace threat intelligence.