Siemens has confirmed that attackers have actively exploited a DLL side-loading vulnerability within the Siemens Software Center to deliver malware through a ClickFix campaign.
Attackers have exploited the fact that Siemens Software Center doesn’t fully restrict the folder it searches when looking for DLL files. This allows an authenticated local attacker to plant a malicious DLL and run code with the application’s privileges.
This flaw has been assigned CVE-2026-110936 with a CVSS v4.0 score of 8.4. The vulnerable version, 3.5.8.7, was the latest release when the attacks took place, so up-to-date systems were exposed.
The attack is initiated using social engineering: a target user is encouraged to paste a command line into the Windows Run box or PowerShell.
The attackers would typically frame this as a fix or verification step. Because the user runs the command themselves, it can slip past security tools designed to block unauthorized activity.
This command then downloads AllMyBasic.msi from a distribution server linked to the Romulus ClickFix campaign. This, in turn, drops a valid copy of Siemens Software Center into an “SM Software Provisioning Service” folder, alongside the attacker’s malicious DLLs.
When the signed executable launches, the malicious DLLs are loaded without being checked, because they are stored in the same folder. The attacker’s malicious code then runs with the valid Siemens signature.
The malware then embeds itself through startup apps or Task Scheduler, connecting to other attacker infrastructure like 96.62.218[.]59.
How to stay protected
Siemens has fixed the flaw within version 4.0.9.8, alongside the advisory (SSA-580366) on October 15, 2026. Existing installations update to 4.0.9.8 automatically the next time the app starts.
Siemens said: “No Siemens system, product or update channel was breached to our knowledge.” The vulnerability was originally reported by Jose Oregon from Huntress Labs.
Siemens has warned users to check endpoints for the following signs:
- An unexpected Siemens Software Center entry in startup apps or Task Scheduler
- An “SM Software Provisioning Service” folder under AppData\Local\Programs
- activate.bak or statinfosta.DB files next to the executable
- An FTSuite folder containing ftc.uml under AppData\Local
- Connections to 96.62.218[.]59 or wizardexpensive[.]com
Organizations should block the listed infrastructure and search their logs for past connections to it. Logs should also be checked for the distribution IP 2.27.248[.]127, which is now inactive.
Users should also be reminded never to paste unknown commands from web pages into the Run box or PowerShell.
