As reported by The Hacker News, Siemens has patched a high-severity DLL sideloading vulnerability in Siemens Software Center that was actively exploited in the wild as part of ClickFix campaigns. The flaw, CVE-2026-110936 (CVSS v4: 8.4), allowed authenticated local attackers to plant a malicious DLL in the application's search path, achieving arbitrary code execution with the privileges of the affected service. Huntress Labs researcher Jose Oregon is credited with the discovery.
This is not a theoretical exposure. Siemens disclosed that attackers weaponized a legitimately signed copy of Siemens Software Center v3.5.8.7 and placed a crafted archive.dll beside it — bypassing application control and reputation-based defenses precisely because the carrier binary was trusted. The delivery mechanism, attributed to a ClickFix platform called Romulus (recently detailed by Forescout), leverages fake browser verification prompts and, notably, malicious ChatGPT Custom GPTs to social-engineer victims into running PowerShell that ultimately drops an MSI installer and sideloads the payload.
Why this matters
DLL sideloading remains one of the most consistently under-defended classes of local privilege/code execution flaws — and it thrives on trust. When an attacker can coerce a user into running a signed, vendor-binary launcher, most EDR solutions and application whitelisting policies wave it through. The Siemens case is a textbook example: the attacker didn't need to compromise a Siemens infrastructure component. They simply needed a signed Siemens binary that loaded unqualified helper DLLs from a writable, user-controlled path.
The second-order concern is the social engineering supply chain. The abuse of Custom GPTs to route victims toward ClickFix lures illustrates how generative-AI surfaces are now an established pre-attack vector. Defenders who treat ChatGPT and similar platforms as out-of-scope for threat modeling are leaving a gap that ransomware affiliates and initial access brokers are actively exploiting.
Vulnerability details
| CVE | CVE-2026-110936 |
|---|---|
| CVSS v4 | 8.4 (High) |
| Affected product | Siemens Software Center (versions prior to 4.0.9.8) |
| Vendor | Siemens |
| Patch status | Fixed in version 4.0.9.8 — the application must be started after updating to apply the fix |
| Active exploitation | Yes — observed in Romulus/ClickFix campaigns delivering Legion Loader and remote access trojans |
| Known IOCs | 96.62.218.59, 2.27.248.127, wizardexpensive[.]com; AllMyBasic.msi; SiemensSoftwareCenter.exe launched by msiexec.exe from AppData\Local\Programs |
Who is at risk
- Industrial, manufacturing, and engineering organizations running Siemens Software Center on engineer or operator workstations — these are high-value targets for follow-on ICS-adjacent activity.
- Environments where EDR coverage on engineering laptops is inconsistent or where signed-binary trust is broadly granted.
- Organizations whose acceptable-use policies permit end users to interact with public generative-AI assistants without monitoring.
Shield53 Recommendations
- Patch immediately to Siemens Software Center 4.0.9.8 or later and confirm the application is launched at least once post-update so the fix takes effect.
- Detect the attack pattern: hunt for
SiemensSoftwareCenter.exeexecuting from%LOCALAPPDATA%\Programs\and started bymsiexec.exe, and forarchive.dllin the same directory. These should be near-zero noise signals in most enterprises. - Block the IOCs at perimeter and DNS egress: 96.62.218.59, 2.27.248.127, and wizardexpensive.com.
- Constrain DLL search behavior at the OS level using the mandatory
CWD_DLL/ SafeDLLSearchMode controls and consider application-specific folder ACLs so non-admin users cannot drop DLLs adjacent to trusted binaries. - Monitor generative-AI surfaces: add known ClickFix landing patterns, fake "verify you are human" flows, and PowerShell-oneliner staging commands to your endpoint detection rules and to user phishing reporting.
- Review MSI execution: alert on
msiexec.exespawning signed vendor binaries from user-writable paths — this sideloading pattern will recur across other vendors.
The lesson here isn't specific to Siemens. Any signed vendor binary that loads unqualified DLLs from its own folder is a future Romulus carrier. Treat DLL search-order hardening as a procurement requirement, not a post-incident response.
