Overview
- Siemens confirmed in a blog post on Monday that CVE-2026-110936 is being exploited to load attacker-supplied DLLs next to a legitimate, signed SiemensSoftwareCenter.exe.
- The vulnerability is an uncontrolled DLL search-path flaw that lets a local attacker place a crafted DLL and run code with the application’s privileges and it has been fixed in Software Center version 4.0.9.8.
- Investigators linked the abuses to the Romulus ClickFix delivery platform, which uses social engineering lures that trick victims into running commands that drop MSI installers like AllMyBasic.msi.
- Siemens published indicators of compromise and guidance to block listed IPs and domains and to look for SiemensSoftwareCenter.exe running from AppData\Local\Programs launched by msiexec.exe.
- Security firms credited Huntress researcher Jose Oregon for reporting the flaw and Siemens says its distribution channels were not breached while it shares telemetry with EDR vendors and authorities.