Siemens Patches Software Center Flaw Exploited in Romulus ClickFix Campaign

Threat actors are actively exploiting a newly disclosed DLL side-loading vulnerability in Siemens Software Center, tracked as CVE-2026-110936, as part of an ongoing social engineering and malware delivery campaign known as Romulus ClickFix. Siemens updated its advisory after security researcher Jose Oregon from Huntress Labs reported the flaw, releasing version 4.0.9.8 to remediate the issue and subsequently confirming active exploitation in the wild.

The target software, Siemens Software Center, is the primary utility used by administrators and engineers to download, install, and manage official Siemens applications across enterprise and industrial environments. Because the application is a legitimate, digitally signed administrative binary, attackers leverage it as an unsuspecting host to evade detection by Endpoint Detection and Response (EDR) solutions.

Mechanics of the Vulnerability and Exploitation

The underlying flaw is categorized as an Uncontrolled Search Path Element vulnerability (CWE-427). Prior to version 4.0.9.8—specifically impacting version 3.5.8.7—the main executable, SiemensSoftwareCenter.exe, attempted to load helper dynamic link libraries (DLLs) directly from its active working directory without validating their cryptographic signatures or verifying that the libraries resided in a secured system path.

Attackers capitalized on this trust mechanism by distributing a trojanized installer package named AllMyBasic.msi. This installer places a legitimate, unmodified, signed copy of SiemensSoftwareCenter.exe alongside a malicious DLL crafted by the attackers. When the legitimate Siemens binary runs, Windows resolves dependencies by checking the local directory first, executing the attacker’s DLL within the security context of the trusted process.

Siemens confirmed that its own update channels, repositories, and supply chains were not breached. Instead, the malicious packages are hosted and distributed entirely on external attacker-controlled infrastructure.

Distribution relies on the “ClickFix” execution technique. Rather than delivering a conventional malicious email attachment or relying on a web browser download, ClickFix lures victims using compromised or malicious web pages displaying fake error messages or “I am not a robot” CAPTCHA prompts. The prompt tricks the victim into copying a malicious command to their clipboard and pasting it directly into the Windows Run prompt (Win+R) or a PowerShell console. This bypasses standard browser file inspection controls and initial network defenses, executing an inline script that fetches the MSI payload.

The Romulus Infrastructure and Payload Analysis

Recent threat intelligence from Forescout’s Vedere Labs links the deployment infrastructure directly to a multi-payload delivery platform designated as ROMULUS. Researchers identified a centralized administration panel managing six distinct IP addresses hosting staging scripts and installer payloads.

One specific IP address identified in the campaign, 2.27.248[.]127, hosted the malicious AllMyBasic.msi installer. Analysis of the platform indicates ROMULUS operates as a commercial cybercrime-as-a-service or shared affiliate delivery backend rather than a single threat group’s proprietary infrastructure. It generates PowerShell staging scripts and trojanized installers on demand to drop various malware families.

Among the payloads observed deployed through this vector is LegionLoader, a specialized malware loader capable of extracting sensitive data, session cookies, and stored credentials from Google Chrome and other Chromium-based browsers.

Risk Assessment and EPSS Metrics

Siemens assigned CVE-2026-110936 a CVSS v4.0 score of 8.4 (High). Under CVSS v3.1 scoring, the vulnerability carries a vector of CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, indicating that while local access and high privileges are required for arbitrary DLL loading in standard privilege boundaries, execution yields complete loss of confidentiality, integrity, and availability for the local system context.

At the time of writing, the Exploit Prediction Scoring System (EPSS) assigns CVE-2026-110936 a probability score of 0.14% (2.7th percentile). Defenders should exercise caution when evaluating this metric: EPSS models heavily weigh broad-scale automated scanning and remote code execution telemetry across internet-facing surfaces. Because DLL side-loading relies on client-side social engineering (ClickFix) and local execution rather than network-based exposure, low EPSS scores do not reflect actual operational risk when active exploitation in the wild is confirmed.

The blast radius is particularly significant for industrial and engineering organizations. Siemens Software Center is routinely deployed on workstations used to configure Programmable Logic Controllers (PLCs), Human-Machine Interfaces (HMIs), and Supervisory Control and Data Acquisition (SCADA) systems. Compromising these endpoints provides initial access that attackers can pivot from to access Operational Technology (OT) networks or steal industrial intellectual property.

Remediation and Defensive Actions

Organizations utilizing Siemens Software Center should execute the following mitigation procedures immediately:

1. Update Siemens Software Center: Upgrade all deployments to version 4.0.9.8 or higher. Existing installations configured with standard defaults will update automatically upon launching, but IT and OT administrators should verify installation versions across managed assets. Ensure all installer files are sourced exclusively from official Siemens portals.
2. Threat Hunting and Detection: Search endpoint logs for instances of SiemensSoftwareCenter.exe launched directly from non-standard user directories, specifically paths matching AppData\Local\Programs when initiated via msiexec.
3. Network Indicators: Block known distribution infrastructure, including IP address 2.27.248[.]127, at network perimeters, web gateways, and DNS firewalls.
4. Incident Response Protocol: If an infected host is detected, immediately isolate the system from the network, terminate running instances of SiemensSoftwareCenter.exe associated with untrusted directories, remove persistent startup entries created by msiexec or PowerShell, and perform mandatory credential resets for all accounts utilized on that machine.
5. User Awareness: Remind staff that legitimate security checks or CAPTCHAs will never instruct users to paste commands into Win+R or PowerShell.