Siemens has patched a high-severity flaw in Siemens Software Center after confirming that attackers were already exploiting it to deploy a remote access trojan. Tracked as CVE-2026-110936 with a CVSS v4 score of 8.4, the vulnerability is a DLL sideloading weakness that let attackers piggyback on a signed, trusted Siemens application to run their own malicious code. If your organization uses Siemens Software Center, updating to version 4.0.9.8 is the single most important thing you can do today.
What makes this case notable is the delivery method: the attacks arrived through ClickFix-style lures, some of them seeded by malicious ChatGPT Custom GPTs that steered victims to a fake download page. The victim thought they were installing a legitimate tool. Behind the scenes, the installer abused the trusted Siemens executable to silently load an attacker-controlled DLL. This is a textbook example of how modern attackers hide inside software you are supposed to trust.
What is the Siemens Software Center vulnerability?
CVE-2026-110936 is a DLL sideloading vulnerability in Siemens Software Center. The application loads dynamic-link libraries from an uncontrolled search path, which means an authenticated local attacker can place a specially crafted DLL in a directory the application searches. When the program starts, it loads the attacker’s file instead of the legitimate one, executing malicious code with the same privileges as the affected application.
Siemens credited Huntress Labs researcher Jose Oregon with discovering and reporting the flaw. In a separate alert, Siemens confirmed the issue was not theoretical: threat actors had already abused a genuine, validly signed copy of Siemens Software Center as a carrier, dropping their own crafted DLL (named archive.dll) next to it to trigger code execution.
The reason attackers picked this particular program is instructive. According to Siemens, they chose it because it was signed and trusted, and because version 3.5.8.7, the latest version at the time of the attacks, loaded helper files from its own folder without verifying them. Endpoint security tools that trust signed executables are far less likely to flag a program carrying a legitimate Siemens signature, even when it is loading a poisoned DLL from beside it.
How the attacks worked: ClickFix lures and the Romulus platform
Investigators found that the malicious activity was delivered through a ClickFix platform called Romulus, which security researchers at Forescout documented the previous week as a delivery vehicle for Legion Loader and other malware families using DLL sideloading.
The infection chain looked like this:
- The victim is directed to a fake URL serving a ClickFix lure. In some campaigns, the lure was reached through malicious ChatGPT Custom GPTs that pointed users at the bogus page.
- The victim copies and runs a PowerShell command from the page, which downloads and drops an MSI installer.
- The Windows installer service (msiexec.exe) launches the MSI package, named AllMyBasic.msi.
- The installer drops a legitimate, signed SiemensSoftwareCenter.exe alongside the attacker’s archive.dll.
- SiemensSoftwareCenter.exe starts and, because of the sideloading flaw, loads the malicious DLL, which deploys the remote access trojan.
Security teams should look for SiemensSoftwareCenter.exe running from AppData\Local\Programs and started by msiexec.exe, which is a strong indicator that this delivery chain was used.
Why DLL sideloading keeps working
DLL sideloading is one of the oldest tricks in the attacker playbook, and it keeps working because it abuses trust rather than breaking cryptography. Windows applications routinely search several directories for the helper libraries they need. If the application folder is writable, an attacker simply places a malicious DLL with the expected filename where the application will find it first. The operating system then loads it with full trust because the parent process is legitimate.
The defense layers that are supposed to catch this often fail in practice. Code-signing validates the main executable, not every library it loads at runtime. Application allowlisting that trusts a signed parent process can miss the poisoned DLL entirely. And because the malicious code inherits the application’s privileges and network profile, outbound command-and-control traffic can blend in with normal update-check activity. Attacks like this one, and the broader wave of supply-chain compromises hitting developer tooling this year, show that attackers are deliberately hunting for signed, trusted carriers rather than writing malware from scratch. A recent example of this same carrier strategy is the Tensorlake npm compromise, where attackers hid their worm inside a legitimate package update pipeline to steal developer credentials.
What Siemens says to do right now
Siemens fixed the flaw in Siemens Software Center version 4.0.9.8. The guidance is straightforward:
- Update to version 4.0.9.8 or later, then start the application so the update is applied.
- Block the known indicators of compromise. Siemens shared the following IOCs associated with the campaigns:
- 96.62.218.59 (payload hosting and command-and-control)
- wizardexpensive.com (payload hosting and command-and-control)
- 2.27.248.127 (distribution channel for AllMyBasic.msi)
- Hunt for the infection chain. Check endpoints for SiemensSoftwareCenter.exe running from AppData\Local\Programs with msiexec.exe as its parent process. Any hit deserves an immediate forensic review.
- Review recent installs. Because the lure arrived as an MSI that victims ran themselves, review helpdesk tickets and user reports for any manual software installs in the past few weeks, particularly ones tied to unusual URLs.
If you find evidence of the malicious MSI or the sideloaded DLL on a system, treat it as a full compromise: isolate the host, capture memory and disk images, reset credentials that transited the machine, and assume the remote access trojan had the same access the user did.
Longer-term hardening against sideloading
Patching closes this specific hole, but DLL sideloading as a technique will not go away. Organizations that manage fleets of Windows endpoints should consider a few durable controls. Enforce Windows Defender Application Control or a comparable allowlisting policy that validates DLLs, not just executables. Monitor for process-parent anomalies, especially signed applications spawning from unusual locations or launched by installers users ran manually. Restrict write access to application directories where possible. And keep user education specific: the ClickFix pattern of copying a PowerShell command from a web page into a terminal is the human step this whole chain depends on, so make sure users know that no legitimate support page will ever ask them to do that.
How this fits the bigger picture
This incident landed in the middle of a rough month for widely deployed enterprise software. Actively exploited flaws have been disclosed in quick succession across remote-access and virtualization platforms, and attackers have grown skilled at pairing a technical vulnerability with a social-engineering delivery method. The Citrix NetScaler SAML zero-day followed a similar pattern of rapid exploitation after disclosure, and the KVM VM escape disclosed earlier this month showed the same preference for abusing trusted infrastructure components.
The Siemens case adds a new wrinkle: the use of ChatGPT Custom GPTs as a lure distribution channel. That turns a productivity tool into an attack surface, and it is something security teams will need to account for in their web-content policies. When the lure itself arrives inside a familiar, trusted interface, even careful users are more likely to comply.
Frequently asked questions
What is CVE-2026-110936?
CVE-2026-110936 is a high-severity DLL sideloading vulnerability in Siemens Software Center, rated CVSS v4 8.4. It lets an authenticated local attacker place a malicious DLL in a directory the application searches, causing the signed Siemens application to execute attacker code with its own privileges.
Which versions of Siemens Software Center are affected?
Siemens patched the issue in version 4.0.9.8. Version 3.5.8.7, which was the latest version at the time attackers were observed exploiting the flaw, loads helper files from its own folder without verifying them. You should update to 4.0.9.8 or later and start the application to apply the update.
Was CVE-2026-110936 exploited in the wild?
Yes. Siemens confirmed the vulnerability was exploited in ClickFix attacks, attributed to a delivery platform called Romulus. Attackers used msiexec.exe to launch an MSI package (AllMyBasic.msi) that executed a genuine signed copy of SiemensSoftwareCenter.exe alongside a malicious archive.dll, ultimately deploying a remote access trojan.
How did victims get infected?
Victims were directed to a fake URL serving a ClickFix lure. Some campaigns used malicious ChatGPT Custom GPTs to steer users to the page. The victim copied and ran a PowerShell command from the page, which downloaded the MSI installer that set up the DLL sideloading chain.
What should I do if I find the malicious files on my systems?
Isolate the host immediately and treat it as a full compromise. Capture forensic images, reset credentials that passed through the machine, block the published indicators of compromise, and update every instance of Siemens Software Center to 4.0.9.8 or later.
What are the indicators of compromise for this campaign?
Siemens published three IOCs: the IP 96.62.218.59 and the domain wizardexpensive.com (payload hosting and command-and-control), and the IP 2.27.248.127 (distribution channel for AllMyBasic.msi). Also look for SiemensSoftwareCenter.exe running from AppData\Local\Programs with msiexec.exe as its parent process.