Siemens Software Center Flaw Abused in ClickFix Campaign

Siemens Software Center versions before V4.0.9.8 load DLLs from the folder the executable sits in without validating which paths are acceptable. CVE-2026-110936 (CVSS 6.7, medium per NVD) documents this behavior. An authenticated local attacker who can write to that directory can place a crafted DLL there and have it run with the application’s privileges the next time Software Center launches.

The technical bar is “local authenticated access,” which sounds low-risk until you factor in how the Romulus ClickFix campaign is actually delivering the package. Huntress researcher Jose Oregon published findings on October 15, 2026, describing the campaign: attackers bundle a legitimate, digitally-signed copy of the Siemens executable together with malicious DLLs and push the package through fake CAPTCHA prompts. A user who follows the prompt runs a command that drops the bundle to disk, and when the Siemens executable launches, it finds the attacker’s DLLs in its working directory and loads them. The payload in this campaign is LegionLoader, a malware loader that delivers remote access trojans. Siemens’ infrastructure was not compromised; the campaign borrows the legitimate binary because signing status matters to endpoint detection.

Active in-the-wild exploitation was confirmed on October 19, 2026. Siemens released V4.0.9.8 on October 17, and the update installs automatically the next time Software Center opens. Check for LegionLoader process activity and review the indicators of compromise Huntress published alongside the SecurityWeek writeup. If Siemens Software Center is deployed in an environment that has fielded ClickFix lures recently, treat any unrecognized DLL in the Software Center working directory as a potential incident.

What to do

Update Siemens Software Center to V4.0.9.8 as soon as possible. The update deploys on next launch, so no manual installation step is required. Organizations running Software Center in environments where users interact with web forms or browser-based prompts should treat ClickFix-style CAPTCHA pages as a known initial access vector and block execution of commands pasted from browser prompts where policy allows.

Related coverage

• Industrial Engineer Jailed for 20-Bitcoin Extortion — insider threat context for ICS environments
• FBI Seizes Domains for Flax Typhoon Breach Tools — state-adjacent tooling in OT-adjacent infrastructure
• Advantech WISE-6610 Firmware Hit by CVSS 9.9 RCE — recent vendor firmware exposure in ICS/OT