Threat reportVulnerabilityTL-2026-3936
Siemens Software Center DLL Sideloading Vulnerability (CVE-2026-110936) Exploited in ClickFix Malware Attacks
Siemens Software Center DLL Sideloading Vulnerability (TL-2026-3936), also tracked as Romulus ClickFix campaign, is a high-severity software vulnerability scored CVSS 8.4, first published 2026-10-20. It has no confirmed attribution, affects Siemens Siemens Software Center, references 1 CVE (CVE-2026-110936), maps to 13 MITRE ATT&CK techniques (T1027.003, T1027.010, T1036.005), and is covered by 9 detection rules and 27 indicators of compromise.
- CVSS
- 8.4/10High
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 13MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 27Indicators of compromise
Key facts for TL-2026-3936
- Threat ID
- TL-2026-3936
- Also known as
- Romulus ClickFix campaign, SSA-580366
- Severity
- HIGH
- CVSS
- 8.4 (CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- industrial, manufacturing, engineering, technology
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 27
Malware and tooling in Siemens Software Center DLL Sideloading Vulnerability
Malware and tooling: Satacom
How Siemens Software Center DLL Sideloading Vulnerability works
Threat actors are exploiting CVE-2026-110936, a DLL search-path flaw (CWE-427) in Siemens Software Center versions prior to 4.0.9.8, by pairing a legitimately signed Siemens executable with malicious DLLs delivered through ClickFix lures. Siemens ProductCERT links the activity to the Romulus multi-platform ClickFix delivery platform and LegionLoader.
CVE-2026-110936 is an uncontrolled search path element (CWE-427) in Siemens Software Center, the Siemens tool used to download, install and update Siemens software. All versions prior to V4.0.9.8 load dynamic-link libraries from the application's own folder without restricting or validating the search locations. Siemens advisory SSA-580366 (published 2026-10-15) and NVD rate the flaw CVSS v4.0 8.4 (CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) and CVSS v3.1 6.7 (AV:L/PR:H); the advisory describes the attacker as an authenticated local user whose code runs with the privileges of the application. NVD lists the record as awaiting analysis and, at time of writing, CISA KEV data showed no listing.
On 2026-10-19 Siemens ProductCERT published a blog post confirming active exploitation and revised SSA-580366 to V1.2 to reference it. Attackers obtained a legitimate, digitally signed copy of SiemensSoftwareCenter.exe and shipped it alongside malicious DLLs. Victims are lured with ClickFix social engineering (fake CAPTCHA / verification prompts that make the user paste and run a command). When the signed executable launches it loads the attacker-supplied DLLs from its own folder, executing attacker code under a trusted, signed process. Siemens documents the process pattern of SiemensSoftwareCenter.exe running from AppData\Local\Programs and launched by msiexec, and reports the activity as part of the Romulus multi-platform ClickFix campaign.
Romulus (ROMULUS) was documented by Forescout Vedere Labs on 2026-10-14 as a multi-payload, reusable ClickFix delivery backend; six servers running it were identified and its operator is unknown (it is separate from Proofpoint's RomulusLoader). Forescout describes a Route A that downloads a trojanized MSI containing the signed Stardock DeElevate64.exe sideloading a malicious loader DLL, and a Route B in which PowerShell fetches 7zr.exe, performs nested password-protected 7z extractions and runs an artificially inflated (~842 MiB) PE that delivers LegionLoader via multi-stage AES encryption. LegionLoader is known to sideload malicious libraries impersonating files such as 7z.dll and normaliz.dll. The same infrastructure overlaps with the September 2026 Huntress-reported campaign that abused rogue ChatGPT Custom GPTs ('Plus 5.6') to deliver an eight-stage chain using signed Canon and Stardock binaries, WAV-hidden payloads, AMSI bypass, ntdll unhooking, HKCU Run and scheduled-task persistence, and DNS-over-HTTPS for C2 lookups.
The flaw was reported by Jose Oregon of Huntress. Siemens released V4.0.9.8 on 2026-10-17, delivered automatically on next application launch; no workarounds are documented. Because the attack abuses a signed vendor binary shipped by the attacker, defenders should hunt for Siemens Software Center executables running from user-writable paths with unexpected neighbouring DLLs and artifacts rather than rely on signature trust. The public sources do not name a threat actor or state a victim count for the Siemens-specific activity.
MITRE ATT&CK techniques used in TL-2026-3936
Defense Evasion
T1027.003 Steganography; T1027.010 Command Obfuscation; T1036.005 Masquerading: Match Legitimate Resource Name or Location; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1218.007 System Binary Proxy Execution: Msiexec; T1574.001 DLL
Persistence
T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder
Execution
T1059.001 PowerShell; T1204.004 Malicious Copy and Paste
Credential Access
T1555.003 Credentials from Web Browsers
stealth
defense-impairment
Affected products and versions in Siemens Software Center DLL Sideloading Vulnerability
- Siemens — Siemens Software Center
Vulnerable versions: All versions prior to V4.0.9.8 (3.5.8.7 was the newest at time of exploitation)
Fixed in: V4.0.9.8 or later
Remediation for Siemens Software Center DLL Sideloading Vulnerability
Patches
- Siemens Software Center V4.0.9.8 (SSA-580366)
Immediate actions
- Update Siemens Software Center to V4.0.9.8 or later (auto-updates on next application launch)
- Block 96.62.218.59, 2.27.248.127, wizardexpensive.com and the related ROMULUS/LegionLoader infrastructure at firewall, DNS and proxy
- Isolate hosts where SiemensSoftwareCenter.exe runs from AppData\Local\Programs or alongside activate.bak / statinfosta.DB, and reset credentials used on them
- Hunt for the 'SM Software Provisioning Service' folder in AppData\Local\Programs and the FTSuite folder with ftc.uml in AppData\Local
Workarounds
- No workaround documented by Siemens; update to the fixed version
Longer-term hardening
- Download Siemens software only from official Siemens sources
- Alert on suspicious DLLs placed next to signed vendor executables in user-writable directories
- Restrict PowerShell and msiexec use by standard users and train users on ClickFix paste-and-run lures
- Alert on decimal-notation IPs in URLs, powershell -ep bypass / -w hidden, and 7zr.exe followed by launch of very large executables
CVEs associated with Siemens Software Center DLL Sideloading Vulnerability
Weaknesses (CWE) in Siemens Software Center DLL Sideloading Vulnerability
Timeline of Siemens Software Center DLL Sideloading Vulnerability
- OpenAI removes the first malicious 'Plus 5.6' ChatGPT Custom GPT after Huntress reports a ClickFix campaign sharing delivery infrastructure with the later Romulus activity.
- Operators bring a replacement malicious Custom GPT online within two days of the takedown.
- Huntress publishes its analysis of the eight-stage ClickFix chain using signed Canon and Stardock executables for DLL sideloading, with at least 40 related incidents.
- Forescout Vedere Labs publishes the ROMULUS multi-payload ClickFix delivery platform (six servers) and the LegionLoader route; Huntress updates its post with new domains.
- Siemens publishes SSA-580366 for CVE-2026-110936 (CVSS v4.0 8.4); NVD record created.
- Siemens Software Center V4.0.9.8 is released and delivered automatically on next application launch.
- Siemens ProductCERT confirms active exploitation, publishes IOCs and updates SSA-580366 to V1.2; SecurityWeek reports the activity.
Sources cited for Siemens Software Center DLL Sideloading Vulnerability
- Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks
- SSA-580366: DLL Sideloading Vulnerability in Siemens Software Center
- Active Exploitation of CVE-2026-110936 in Siemens Software Center
- NVD - CVE-2026-110936
- ROMULUS Malware Server Leverages ClickFix to Deliver Multiple Payloads
- Forescout Vedere Labs: ROMULUS multi-payload ClickFix delivery platform
- Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix
- Hackers Use ChatGPT Custom GPTs in ClickFix Attacks
- ChatGPT Custom GPTs Weaponized for ClickFix RAT Delivery (CSA research note)
Detection coverage for TL-2026-3936
As of 2026-10-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3936 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-3936
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.