By Evan Lee Salim 
Siemens issued a critical security notification on Monday, confirming that threat actors have been actively exploiting a high-severity vulnerability within the Siemens Software Center. The flaw, which has been formally tracked as CVE-2026-110936, allows attackers to bypass security protocols by leveraging a DLL side-loading technique. This development marks a significant escalation in the ongoing campaign attributed to the "Romulus" platform, an infrastructure known for orchestrating multi-payload "ClickFix" attacks.
The Siemens Software Center is a foundational component of the company’s digital ecosystem, responsible for managing the lifecycle of proprietary software. It serves as the primary portal for customers to download, install, activate, and update purchased applications, as well as initiate free trials. By exploiting this central hub, attackers have sought to gain unauthorized execution privileges on victim machines, raising concerns for industrial and enterprise users who rely on these tools for critical operations.
Understanding the Vulnerability: CVE-2026-110936
The vulnerability exists due to a failure in the Siemens Software Center’s directory management. Specifically, the application does not properly restrict the file system locations it queries when searching for Dynamic Link Library (DLL) files. In a standard, secure implementation, software should only load dependencies from verified, trusted directories. However, in vulnerable versions of the Software Center, the program performs an insecure search.
This design oversight provides a clear path for an authenticated local attacker to plant a malicious DLL within one of the folders scanned by the application. Once the software is launched, it inadvertently executes the malicious code contained within the attacker-supplied file. Because the program loads these dependencies automatically upon startup, the malicious payload runs with the same level of system privileges as the Software Center itself.
Siemens first brought this issue to light on October 15, publishing an official security advisory that assigned the vulnerability a CVSS v4 score of 8.4. This high score reflects the severity of the flaw, particularly given the potential for privilege escalation. Two days later, on October 17, Siemens updated its advisory to confirm that version 4.0.9.8 of the Software Center effectively resolves the issue by implementing proper validation for helper files. Users currently running the software will receive the update automatically during the next application launch, though the company has urged administrators to verify that their installations are running the patched version.
While the initial advisory focused on the technical remediation, it remained silent regarding active exploitation until this past Monday. Siemens updated its communication channels to include a link to a detailed blog post outlining how the vulnerability is being leveraged in the wild, providing evidence that the flaw is not merely theoretical but a primary vector for active cyber-attacks.
Anatomy of the Attack: The Role of DLL Side-Loading
The methodology employed by the attackers highlights a clever, if deceptive, use of legitimate software. In the observed campaigns, threat actors bundled a genuine, digitally signed copy of the Siemens Software Center with a collection of malicious DLLs. Because the Siemens software carries a valid digital signature, it is often treated as a trusted entity by Windows security features and antivirus engines, allowing it to bypass basic reputation-based filters.
When the user runs the bundled program, the software initializes and inadvertently loads the attacker-supplied DLLs from its own directory rather than the intended system locations. Siemens noted that version 3.5.8.7—the latest release prior to the patch—did not perform the necessary validation of these helper files before execution. By using this "side-loading" technique, the attackers effectively hijacked a legitimate process to perform their malicious work.
Crucially, Siemens has been quick to emphasize that this campaign does not involve a compromise of the company’s internal infrastructure. "No Siemens system, product or update channel was breached to our knowledge," the company stated. The attackers are sourcing the legitimate Siemens software from public channels and modifying the package locally before distributing it to victims. The malicious bundles are not traveling through official Siemens distribution channels, meaning the integrity of the original software remains intact until it is intercepted and "trojanized" by external bad actors.
To combat this, Siemens is working closely with law enforcement authorities and Endpoint Detection and Response (EDR) providers. The company’s blog post provides comprehensive indicators of compromise (IoCs), including file paths and behavioral signatures, to assist security teams in identifying potentially infected machines. Given that the malicious payload relies on a legitimate Siemens binary, the company has cautioned defenders against relying solely on file hashes, which will match the legitimate software. Instead, security operations centers are encouraged to focus on identifying suspicious behavioral patterns and monitoring the specific folders where these malicious side-loading attempts typically manifest. The vulnerability was initially brought to the attention of Siemens by researcher Jose Oregon of the security firm Huntress.
Siemens Links the Attacks to the Romulus ClickFix Operation
The investigation into the source of these attacks has linked them to "Romulus," a sophisticated multi-platform delivery network designed to facilitate ClickFix operations. ClickFix attacks are a form of social engineering that rely on deceptive user prompts. Often appearing as fake CAPTCHA challenges or system error messages, these prompts trick users into believing they must copy and execute a specific command in their terminal or PowerShell to "fix" an issue or verify their identity. By following these instructions, the user unwittingly grants the attacker full control over their device.
Recent research published by Forescout provided an in-depth analysis of the Romulus platform, characterizing it as a highly capable delivery mechanism that can serve a wide array of malware payloads. Forescout observed the platform operating on several servers, including one that was identified as the specific distribution point for the trojanized Siemens software bundles.
The reach of the Romulus platform is significant. Forescout researchers documented the platform delivering "LegionLoader," a notorious piece of malware, alongside other trojanized installers. In previous instances, the platform was observed abusing legitimate applications from other vendors, such as Stardock, to perform similar DLL side-loading maneuvers. The flexibility of the Romulus infrastructure—which researchers believe may function as a private tool, a service-for-hire, or an affiliate-driven operation—suggests that threat actors are continuously scanning for new, signed applications to exploit.
This trend was echoed in a late-September report from Huntress, which documented a campaign utilizing rogue ChatGPT Custom GPTs to lure victims into the ClickFix trap. That campaign targeted users by masquerading as legitimate software installers, including signed programs from Canon and Stardock, to deploy Remote Access Trojans (RATs). Huntress confirmed responding to at least 40 distinct incidents linked to these campaigns and expressed concerns that the strategy is likely being applied to a broad spectrum of legitimate software from various vendors.
While the Siemens Software Center was not explicitly named in earlier reports from Huntress or Forescout, the architectural similarities in the attack chain—specifically the use of DLL side-loading to achieve code execution—strongly suggest that Siemens software has been integrated into the existing Romulus toolkit. As attackers continue to refine their ability to weaponize legitimate, signed binaries, organizations must remain vigilant, prioritizing behavioral monitoring and rapid patching to defend against these increasingly common and difficult-to-detect threats. The ongoing coordination between Siemens, EDR providers, and the broader security community remains a critical effort in neutralizing the impact of the Romulus campaign.
Muslim 
Nana Muazin 
Laily UPN