Siemens Software Center path traversal CVE-2026-110936 added to CISA KEV

1. Executive summary

CVE-2026-110936 is a DLL sideloading flaw in Siemens Software Center, rated CVSS 8.4 HIGH (CWE-427, uncontrolled search path element). Siemens confirmed active exploitation in a ClickFix campaign distributing a trojanized MSI installer (AllMyBasic.msi) that carries a malware loader; the activity is attributed to the Romulus multi-platform ClickFix campaign. The flaw is not in CISA KEV and EPSS is 0%, so the exploitation signal here comes from the vendor's own confirmation of in-the-wild use, not from KEV or EPSS telemetry. For EMEA financial services the exposure is narrow but real: any endpoint running an unpatched Siemens Software Center (fixed in 4.0.9.8) that a user can be socially engineered into running a pasted command against is a candidate for loader execution with the application's privileges, and the loader family observed (LegionLoader) targets credentials stored in Chrome.

2. Regulatory framing

3. Technical analysis & attack chain

The vulnerability is an uncontrolled search path element (CWE-427): Siemens Software Center loads helper DLLs from its own installation folder without validating them. An authenticated local attacker who can write a crafted DLL into a directory the application searches gets code execution at the application's privilege level. Siemens states the executable itself was not tampered with; the attackers used a genuine, validly signed copy of Software Center as a carrier and placed their own files alongside it. Version 3.5.8.7, the latest at the time, was the version that loaded helper files from its own folder unchecked. Version 4.0.9.8 resolves the issue.

Confirmed steps in the observed campaign:

1. A user is lured into a ClickFix prompt and pastes a command into Win+R, the Run box or PowerShell. ClickFix relies on the user executing the command themselves, which avoids a browser download or a file the user must open and sidesteps email and endpoint filtering.
2. The command retrieves and runs AllMyBasic.msi, a trojanized installer distributed outside official Siemens channels. Siemens lists 2.27.248[.]127 as the distribution channel for that installer.
3. The installer places a genuine signed SiemensSoftwareCenter.exe together with attacker-supplied files in the same directory. The signed binary is the carrier; the sideloaded DLL is the payload path.
4. Software Center loads the attacker file from its own folder and executes it, giving the loader the application's privileges.
5. The loader delivers follow-on malware. One payload analysed by Forescout, LegionLoader, collects sensitive information stored in victims' Chrome browsers.

The delivery backend is a panel Forescout's Vedere Labs calls ROMULUS, described as a multi-payload ClickFix delivery platform. Forescout identified six IP addresses running it, one of which (2.27.248[.]127) matches the address Siemens lists for AllMyBasic.msi. The panel serves a PowerShell staging script and the trojanized MSI. Forescout's assessment is that ROMULUS is a reusable delivery backend rather than a single hard-coded malware server.

Attribution and confidence. The link between this exploitation and the Romulus campaign rests on the shared distribution IP (2.27.248[.]127) reported by Forescout and repeated by Help Net Security, and on Siemens' own confirmation of active exploitation. The identity of the operator behind ROMULUS and common ownership of the final malware families are unknown per Forescout; ROMULUS may be a privately operated panel, a commercial delivery service, an affiliate framework, or copied software. No MITRE ATT&CK profile is available for Romulus, so the actor attribution is unconfirmed. The specific IOC set (the six IPs, the panel behaviour) is single-sourced to Forescout's reporting and should be verified before enforcement.

Discrepancy note: the source describes the flaw as DLL sideloading / DLL side-loading; NVD classifies it as CWE-427 uncontrolled search path element. Both describe the same mechanism (an untrusted file loaded from a searched directory), and the verified CWE-427 classification stands.

4. Mitigation & containment

P1 within 24h

• Update Siemens Software Center to 4.0.9.8. Existing installations update automatically the next time they launch; confirm the running version on managed endpoints rather than assuming the auto-update fired.
• Hunt for SiemensSoftwareCenter.exe launched by msiexec from AppData\Local\Programs. Any hit is a candidate infection: isolate the host, stop the process, remove its start-up entries and reset passwords for accounts that used the machine.
• Block the attacker infrastructure listed in the Siemens and Forescout reporting, including 2.27.248[.]127. Treat the IP set as single-sourced; verify before a permanent block.
• Enforce a policy and user communication that no command from a web page is ever pasted into Win+R, the Run box or PowerShell. A legitimate "I am not a robot" check never asks for this.

P2 within 72h

• Restrict execution of MSI installers sourced from user-writable paths (AppData, Downloads, Temp) via application control or EDR rule, so a trojanized installer cannot stage a signed carrier and sideloaded DLL from AppData\Local\Programs.
• Review Chrome credential exposure on any host where the loader is suspected, given LegionLoader's documented collection of data stored in Chrome, and force credential rotation where compromise is plausible.

P3 within 7 days

• Require Siemens software to be obtained only from official Siemens sources, and reconcile installed Siemens packages against that inventory.
• Add detection for the ClickFix paste-and-run pattern at the endpoint (PowerShell or Run-box execution spawned from a browser process) so the entry step is caught before the installer runs.

5. Indicators of compromise

The six ROMULUS panel IP addresses are referenced by Forescout but only one (2.27.248[.]127) is given in the supplied material; the remainder are not reproduced here because their values are not in the source text.

ipv4  2.27.248[.]127
filename  AllMyBasic.msi
filename  SiemensSoftwareCenter.exe
path  AppData\Local\Programs

Behavioural indicators

6. Detection

rule ClickFix_SiemensSoftwareCenter_DLL_Sideload
{
    meta:
        author = "Adverse Trace"
        date = "2026-10-20"
        reference = "https://www.helpnetsecurity.com/2026/10/20/exploitation-siemens-software-center-vulnerability-cve-2026-110936/"
        description = "Detects the trojanized AllMyBasic.msi installer and sideloaded files staged alongside SiemensSoftwareCenter.exe"
    strings:
        $msi = "AllMyBasic.msi" ascii wide nocase
        $exe = "SiemensSoftwareCenter.exe" ascii wide nocase
        $path = "AppData\\Local\\Programs" ascii wide nocase
    condition:
        uint16(0) == 0x5A4D and 2 of them
}

title: Siemens Software Center launched by msiexec from AppData
id: 8f3c2a10-2026-10-20-at-0001
status: experimental
author: Adverse Trace
date: 2026/10/20
references:

  - https://www.helpnetsecurity.com/2026/10/20/exploitation-siemens-software-center-vulnerability-cve-2026-110936/
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\SiemensSoftwareCenter.exe'
    ParentImage|endswith: '\msiexec.exe'
    CommandLine|contains: 'AppData\Local\Programs'
  condition: selection
falsepositives:

  - Legitimate Siemens Software Center installs launched from a managed MSI in AppData
level: high

CVE assessment

1 referenced CVE

7. Sources

• NVD, CVE-2026-110936 detail, https://nvd.nist.gov/vuln/detail/CVE-2026-110936, 2026-10-19
• The Hacker News, ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan, https://thehackernews.com/2026/10/clickfix-attackers-exploit-siemens.html, 2026-10
• Help Net Security, Attackers exploit Siemens Software Center flaw in active ClickFix malware campaign, https://www.helpnetsecurity.com/2026/10/20/exploitation-siemens-software-center-vulnerability-cve-2026-110936/, 2026-10-20
• Forescout Vedere Labs (via Help Net Security), ROMULUS multi-payload ClickFix delivery platform reporting, 2026-10

8. Adverse Trace position

Adverse Trace assesses CVE-2026-110936 as CVSS 8.4 HIGH, not in CISA KEV, EPSS 0%, with exploitation confirmed by the vendor rather than by KEV or EPSS telemetry. The client impact is bounded: the flaw needs a user to run a pasted command and a signed carrier staged from AppData, and the fix (4.0.9.8) is automatic on next launch. The material risk is the loader that follows, given LegionLoader's Chrome credential collection. The actor attribution to Romulus is unconfirmed (no MITRE profile) and the IOC set is single-sourced to Forescout, so we will treat the IP indicators as verification-required before recommending permanent blocks. We will monitor for additional ROMULUS panel IPs and any client-side evidence of SiemensSoftwareCenter.exe spawned by msiexec, and will update this advisory if corroborating sources for the IOC set appear.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.