Attackers exploit Siemens Software Center flaw in active ClickFix malware campaign

Siemens confirmed active exploitation of CVE-2026-110936, a DLL side-loading vulnerability in Siemens Software Center.
The security advisory was initially published on 15 October 2026, assigning the flaw a CVSS v4.0 score of 8.4 (reported by Jose Oregon from Huntress Labs).
Siemens updated its advisory on 17 October, noting version 4.0.9.8 resolves the issue; a warning about active exploitation followed on 19 October.
Attackers used genuine Siemens Software Center installations with valid signatures to carry their files alongside trusted executables.
The specific vulnerability in older versions allowed the program to load helper files from its local folder without verification.
No Siemens system, product, or update channel was confirmed breached by the company.
The malicious installer, AllMyBasic.msi, was distributed outside official channels and is tied to the Romulus ClickFix campaign.
ClickFix functions by coercing users into running malicious commands directly through interfaces like Win+R or PowerShell.
Forescout’s Vedere Labs identified a ROMULUS panel hosting the delivery mechanism; one IP matches Siemens' listed distribution channel for AllMyBasic.msi.
The payload analyzed, LegionLoader, possesses capabilities to exfiltrate sensitive data from victims' Chrome browser storage.

The narrative presents a classic modern threat vector: weaponizing trust infrastructure. The attack exploits the very mechanisms designed for digital integrity—digital signatures and trusted software deployment processes—to bypass endpoint security measures. By leveraging DLL side-loading via Siemens Software Center, the mechanism shifts the point of failure from perimeter defenses to application runtime verification. This suggests that defense strategies must move beyond simple signature validation toward deep process behavior monitoring, particularly concerning how signed executables interact with local or non-standard file paths. The ClickFix tactic further elevates the danger by automating social engineering at the command line level, turning a successful vulnerability exploit into an immediate execution opportunity without requiring user interaction for file retrieval.
The unstated assumption driving this scenario is that software vendors maintain perfect internal audit controls across their entire installed base, a presumption often shattered in practice. Who benefits from these exploits? Threat actors gain access to data deemed "sensitive" (e.g., browser credentials), while the immediate cost falls entirely on organizations relying on legacy or non-patching environments. The second-order consequence is not just data loss, but the erosion of trust in widely used management tools like Siemens Software Center itself.
Patterns detected: none
The playbook for an influence campaign pushing this narrative might involve creating a high volume of technical alerts focusing narrowly on the CVE while strategically underplaying the human element—the ClickFix coercion—to force organizations into immediate patching cycles without fostering deep questions about software supply chain resilience or user security training gaps. The current reporting strikes a reasonable balance by detailing both the technical flaw and the delivery tactic, preventing a purely automated patch mandate from overshadowing behavioral remediation needs. How often is corporate IT audited on *how* installed applications manage local file trust, versus merely checking if the vendor has released a patch? If an attacker can chain a trusted software artifact (Siemens) with a social engineering vector (ClickFix), what does that imply about the true vulnerability of application-level security hygiene across enterprises?