# Siemens Software Center DLL Sideloading Vulnerability (CVE-2026-110936) Exploited in ClickFix Malware Attacks

> Threat actors are exploiting CVE-2026-110936, a DLL search-path flaw (CWE-427) in Siemens Software Center versions prior to 4.0.9.8, by pairing a legitimately signed Siemens executable with malicious DLLs delivered through ClickFix lures. Siemens ProductCERT links the activity to the Romulus multi-platform ClickFix delivery platform and LegionLoader.

- **Published:** 2026-10-20T06:33:40Z
- **Last reviewed:** 2026-10-20T07:45:17.614Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3936
- **ID:** TL-2026-3936
- **Severity:** HIGH (CVSS 8.4)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 39 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-110936

## Description

CVE-2026-110936 is an uncontrolled search path element (CWE-427) in Siemens Software Center, the Siemens tool used to download, install and update Siemens software. All versions prior to V4.0.9.8 load dynamic-link libraries from the application's own folder without restricting or validating the search locations. Siemens advisory SSA-580366 (published 2026-10-15) and NVD rate the flaw CVSS v4.0 8.4 (CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) and CVSS v3.1 6.7 (AV:L/PR:H); the advisory describes the attacker as an authenticated local user whose code runs with the privileges of the application. NVD lists the record as awaiting analysis and, at time of writing, CISA KEV data showed no listing.

On 2026-10-19 Siemens ProductCERT published a blog post confirming active exploitation and revised SSA-580366 to V1.2 to reference it. Attackers obtained a legitimate, digitally signed copy of SiemensSoftwareCenter.exe and shipped it alongside malicious DLLs. Victims are lured with ClickFix social engineering (fake CAPTCHA / verification prompts that make the user paste and run a command). When the signed executable launches it loads the attacker-supplied DLLs from its own folder, executing attacker code under a trusted, signed process. Siemens documents the process pattern of SiemensSoftwareCenter.exe running from AppData\Local\Programs and launched by msiexec, and reports the activity as part of the Romulus multi-platform ClickFix campaign.

Romulus (ROMULUS) was documented by Forescout Vedere Labs on 2026-10-14 as a multi-payload, reusable ClickFix delivery backend; six servers running it were identified and its operator is unknown (it is separate from Proofpoint's RomulusLoader). Forescout describes a Route A that downloads a trojanized MSI containing the signed Stardock DeElevate64.exe sideloading a malicious loader DLL, and a Route B in which PowerShell fetches 7zr.exe, performs nested password-protected 7z extractions and runs an artificially inflated (~842 MiB) PE that delivers LegionLoader via multi-stage AES encryption. LegionLoader is known to sideload malicious libraries impersonating files such as 7z.dll and normaliz.dll. The same infrastructure overlaps with the September 2026 Huntress-reported campaign that abused rogue ChatGPT Custom GPTs ('Plus 5.6') to deliver an eight-stage chain using signed Canon and Stardock binaries, WAV-hidden payloads, AMSI bypass, ntdll unhooking, HKCU Run and scheduled-task persistence, and DNS-over-HTTPS for C2 lookups.

The flaw was reported by Jose Oregon of Huntress. Siemens released V4.0.9.8 on 2026-10-17, delivered automatically on next application launch; no workarounds are documented. Because the attack abuses a signed vendor binary shipped by the attacker, defenders should hunt for Siemens Software Center executables running from user-writable paths with unexpected neighbouring DLLs and artifacts rather than rely on signature trust. The public sources do not name a threat actor or state a victim count for the Siemens-specific activity.

## MITRE ATT&CK

- T1204.004 Malicious Copy and Paste
- T1059.001 PowerShell
- T1218.007 System Binary Proxy Execution: Msiexec
- T1574.001 DLL
- T1574.001 DLL
- T1027.010 Command Obfuscation
- T1027.003 Steganography
- T1140 Deobfuscate/Decode Files or Information
- T1685 Disable or Modify Tools
- T1055 Process Injection
- T1036.005 Masquerading: Match Legitimate Resource Name or Location
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1555.003 Credentials from Web Browsers
- T1574.002 Hijack Execution Flow
- T1105 Ingress Tool Transfer
- T1071.001 Application Layer Protocol
- T1132.001 Data Encoding
- T1573.001 Encrypted Channel
- T1027.001 Obfuscated Files or Information
- T1027.013 Obfuscated Files or Information
- T1497.001 Virtualization/Sandbox Evasion
- T1553.005 Subvert Trust Controls
- T1518.001 Software Discovery
- T1113 Screen Capture
- T1123 Audio Capture
- T1125 Video Capture

## Sources

- [Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks](https://www.securityweek.com/siemens-software-center-vulnerability-exploited-in-clickfix-malware-attacks/)
- [SSA-580366: DLL Sideloading Vulnerability in Siemens Software Center](https://productcert.siemens.com/productcert/html/ssa-580366.html)
- [Active Exploitation of CVE-2026-110936 in Siemens Software Center](https://productcert.siemens.com/news/2026/10/19/active-exploitation-of-cve-2026-110936-in-siemens-software-center/)
- [NVD - CVE-2026-110936](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-110936)
- [ROMULUS Malware Server Leverages ClickFix to Deliver Multiple Payloads](https://www.infosecurity-magazine.com/news/romulus-malware-clickfix-deliver/)
- [Forescout Vedere Labs: ROMULUS multi-payload ClickFix delivery platform](https://www.forescout.com/?p=115732)
- [Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix](https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat)
- [Hackers Use ChatGPT Custom GPTs in ClickFix Attacks](https://securityweek.com/hackers-use-chatgpt-custom-gpts-in-clickfix-attacks)
- [ChatGPT Custom GPTs Weaponized for ClickFix RAT Delivery (CSA research note)](https://labs.cloudsecurityalliance.org/research/csa-research-note-chatgpt-customgpt-clickfix-rat-20261001-cs/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3936