Siemens has confirmed that attackers are exploiting CVE-2026-110936, a DLL search-path flaw in its Software Center application, in a malware campaign tied to the ROMULUS ClickFix platform. The company added a link to a blog post confirming in-the-wild exploitation to its advisory on Monday.
What CVE-2026-110936 Does in Siemens Software Center
CVE-2026-110936 is a DLL search-path flaw. The application does not restrict where it looks for DLL files, so a DLL that an attacker plants runs with the privileges of the application. The flaw carries a CVSS v4 score of 8.4 and a CVSS v3.1 score of 6.7. Siemens tracks it in advisory SSA-580366, and Huntress researcher Jose Oregon reported it.
Siemens published the advisory on October 15 and updated it on October 17 with a fixed version, 4.0.9.8. Installed copies update automatically the next time the application launches. The attackers abused version 3.5.8.7. CISA had not added the CVE to its Known Exploited Vulnerabilities catalog at the time of reporting.
Attackers Shipped a Signed Siemens Binary With Their Own DLLs
The attackers bundled a legitimate, validly signed copy of Siemens Software Center with malicious DLLs of their own. They then used ClickFix lures to persuade victims to install the bundle. Siemens states that no Siemens system, product or update channel was breached and that the program itself was not modified. The abuse relies on the flaw in how the genuine program loads libraries.
The signed binary gives the malware cover. Security tools that trust a host process based on its valid signature can let the side-loaded DLLs run without challenge.
How Forescout Tied the Bundle to ROMULUS Infrastructure
Siemens links the activity to ROMULUS, a multi-platform ClickFix campaign. Forescout’s Vedere Labs found the distribution server for the bundle among ROMULUS infrastructure. Forescout describes ROMULUS as a ClickFix delivery platform that serves fake landing pages, and it identified six IP addresses running it.
Two of the endpoints serve a PowerShell staging script. The script chooses the next payload: either a trojanized MSI installer or an encrypted archive that contains Legion Loader, which is also known as Satacom downloader, CurlyGate and RobotDropper. The archive is padded to nearly 1 GB, a size that helps it evade upload limits and sandbox analysis. The operator behind ROMULUS is unknown. Forescout reports no overlap with the Silver Fox “RomulusLoader.”
Huntress Saw the Same Side-Loading Package With Rogue ChatGPT Custom GPT Lures
Huntress earlier described the same Stardock-based side-loading package in a late-September campaign. That campaign used rogue ChatGPT Custom GPTs as lures and produced at least 40 incidents. The attackers abused signed programs from Canon and Stardock in those cases. Neither the Huntress nor the Forescout report names Siemens. The infrastructure overlap suggests the operators added the Siemens program to their toolkit afterward.
Related chains also deliver a remote access trojan alongside Legion Loader, according to the reporting.
Siemens Response and Guidance for Windows Defenders
Siemens is sharing threat intelligence with authorities and endpoint detection vendors, and it published indicators of compromise. Users should update Software Center to 4.0.9.8. Defenders should hunt for suspicious PowerShell activity and DLL side-loading behavior instead of relying on file hashes, because the attackers reuse legitimate signed binaries and vary their payloads.
What the Siemens Case Shows About Signed-Binary Abuse in ClickFix Toolkits
Operators tied to this toolkit have now abused signed programs from Canon, Stardock and, by infrastructure overlap, Siemens. Siemens published its advisory on October 15, and exploitation was confirmed by October 19, a gap of only days between disclosure and confirmed abuse.
Detection that depends on signature trust alone will miss this class of attack. The ClickFix step also gets victims to run the installer themselves, so the user’s own action starts the infection.
