Siemens Software Center Bug Exploited in ClickFix Malware Push
Siemens confirmed that CVE-2026-110936 in Software Center was being exploited through a malicious installer that paired a valid signed executable with attacker-supplied DLLs. Versions before 4.0.9.8 are affected and should be updated; Siemens linked the activity to the ROMULUS ClickFix campaign and released indicators, while saying it knew of no breach of its own systems or update channel.
Siemens traced the exploitation to a malicious installer delivered outside its official distribution path. It combined a legitimately signed Software Center binary with DLLs supplied by the attacker; the vulnerable application then loaded those files. The defect is an uncontrolled DLL search-path issue (CWE-427), rated CVSS v4.0 8.4 and v3.1 6.7, with vectors indicating local access and high privileges rather than remote unauthenticated use.
All releases before 4.0.9.8 are affected; Siemens advises moving to that build or newer, and current installs apply the update when they next start. The company linked the activity to ROMULUS ClickFix and released network indicators, while saying it knew of no compromise of its own systems, products, or update channel.
The main societal exposure could fall on organizations using Siemens Software Center on Windows engineering or maintenance workstations, where a successful ClickFix lure may lead to malware on systems adjacent to industrial operations. Because the flaw requires local high privileges, impact may depend on user rights and controls. Supply-chain trust could be strained, but Siemens says no breach of its own systems or update channel was known.