Siemens patched a flaw in Siemens Software Center on October 15. Four days later the company confirmed that attackers were already using it. According to Siemens, nobody broke into Siemens to do it. The attackers took a legitimate, validly signed copy of an older version of the program, put their own DLL in the same folder, and let Windows do the rest.

The bug is tracked as CVE-2026-110936. Siemens ProductCERT describes it in advisory SSA-580366 as a DLL side-loading vulnerability. Siemens scores it 8.4 under CVSS v4.0 and 6.7 under CVSS v3.1. Every version of Siemens Software Center below V4.0.9.8 is affected.

What side-loading is, and why a signature does not save you

Windows programs load helper libraries, called DLLs, while they run. When a program asks for a DLL by name without saying exactly where it lives, Windows checks a list of locations, and the program's own folder is usually one of them. If an attacker can put a file with the right name in one of those locations, the program loads it and runs the attacker's code as if it were its own. That is DLL side-loading. Siemens classifies the weakness as CWE-427, "uncontrolled search path element."

According to Siemens' October 19 exploitation notice, the attackers used a genuine, validly signed copy of Siemens Software Center. They chose it, Siemens says, because it is signed and trusted and because version 3.5.8.7, the latest version at the time, loaded helper files from its own folder without checking them. The Hacker News reports that the attackers placed a malicious DLL named archive.dll next to the program. Siemens stresses that its program was not modified. The executable is real, so its signature checks out, and that is what makes the technique attractive: the process doing the work is a trusted, signed Siemens binary.

The two severity scores look far apart, and the gap is worth understanding. The CVSS v3.1 vector Siemens published (AV:L/AC:L/PR:H) means the attack is local, low in complexity, and needs high privileges on the machine. The advisory says an authenticated local attacker who can place a DLL in a directory the program searches gets code execution with the application's privileges. In other words, this is not a remote, wormable bug. It is a way to borrow a trusted program's identity once an attacker, or a user who has been tricked, has already put files on the machine. The NVD record lists both scores as supplied by Siemens, 8.4 HIGH and 6.7 MEDIUM, and as of this writing its status is "Awaiting Analysis."

How the files reach victims: ClickFix

The delivery method is where the social engineering happens. The Hacker News reports that Huntress Labs researcher Jose Oregon is credited with discovering and reporting the flaw. Siemens lists the threat actor attribution as the Romulus multi-platform ClickFix campaign, and The Hacker News likewise attributes the activity to a ClickFix delivery platform called Romulus. It adds that Forescout detailed Romulus the week before as being used to deliver Legion Loader and other malware, also through DLL side-loading.

"ClickFix" refers to a family of lures that persuade the victim to run something themselves, usually by showing a fake error or verification prompt that tells them to paste and run a command. According to Huntress, as reported by The Hacker News, some of these campaigns have used malicious ChatGPT Custom GPTs to direct victims to a fake URL serving the ClickFix lure. The lure runs PowerShell that drops an MSI installer package.

From there, the chain The Hacker News describes runs like this: msiexec.exe, the Windows installer, launches AllMyBasic.msi, which runs SiemensSoftwareCenter.exe. The signed Siemens executable then loads the attacker's DLL from its folder, and the end result is a remote access trojan.

Note the order. The victim is first talked into running the lure, and the side-loading step comes after that. The Siemens flaw does not open a door from outside. It gives malware that has already been dropped a respectable process to hide behind.

Was Siemens compromised?

No, according to Siemens. The company says that to its knowledge no Siemens system, product or update channel was breached. The attackers brought their own copy of an old, legitimately signed release. Siemens also says it has engaged EDR vendors and authorities for intelligence sharing.

What It Means for Defenders

Who is affected. Any Windows machine running Siemens Software Center below V4.0.9.8 has the vulnerable code. The campaign Siemens describes, though, also involves PCs that never had the product installed: Siemens lists "Siemens Software Center" appearing in start-up apps on such a PC as a warning sign, and says the attackers distributed the signed program together with their malicious files outside official channels. That means the main question for most organizations is not only "is our install patched?" but also "has this program turned up somewhere it does not belong?"

Patch. Siemens says to update to version 4.0.9.8 or later. According to the advisory, existing installations update automatically on next startup. If you have machines where the software is installed but rarely opened, start it or push the update so the new version actually lands. Siemens also advises downloading its software only from official Siemens sources.

Hunt for the warning signs Siemens lists:

  • "Siemens Software Center" showing up in startup apps or Task Scheduler on a PC that never had it installed.
  • A folder named "SM Software Provisioning Service" under AppData\Local\Programs, which Siemens says the malware creates.
  • SiemensSoftwareCenter.exe running from AppData\Local\Programs and started by msiexec.exe. Both Siemens and The Hacker News give this as a detection lead. A Siemens program installed per-user by an MSI the user cannot account for deserves a closer look.
  • Siemens also lists network connections to 96.62.218[.]59, and says to detect on folder and behavior rather than the Siemens file fingerprint, because the file itself is genuine.

Block the published indicators. Siemens lists these (defanged here):

  • 96.62.218[.]59: active, used for payload hosting and command-and-control
  • wizardexpensive[.]com: active, same role
  • 2.27.248[.]127: inactive, the distribution channel for AllMyBasic.msi

Check proxy, DNS and firewall logs for past connections to these addresses as well as blocking new ones. Siemens notes that although the inactive channel no longer serves files, systems that downloaded from it before it went offline may still be infected.

Treat ClickFix as the root cause. The side-loading step only happens after a user has been convinced to run something. Siemens advises never pasting a command from a web page into the Run box or PowerShell. User awareness training on that point, plus endpoint controls on script execution, addresses the step that let the attackers in.

For CMMC and other regulated environments, treat a confirmed match on any indicator above as a potential incident, not just a patching task: Siemens says the payload is a remote access trojan running under a trusted, signed process. Siemens' own guidance if signs are found is to isolate the PC, stop the process, remove the start-up entry and task, and reset passwords. Handle it under your incident response procedures, and do not limit the response to removing the files.

Sources