Click Fix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan

Summary: Siemens patched a high-severity DLL sideloading vulnerability in Software Center, tracked as CVE-2026-110936 with a CVSS v4 score of 8.4, that loads libraries from an uncontrolled search path and allows an authenticated local attacker to execute arbitrary code at the application's privileges. Attackers abused a genuine, validly signed copy of Siemens Software Center alongside a crafted "archive.dll", using msiexec.exe to launch AllMyBasic.msi, in activity attributed to a ClickFix delivery platform called Romulus; Huntress researcher Jose Oregon is credited with reporting the flaw, fixed in version 4.0.9.8.
Bottom line: The carrier here was a signed, trusted Siemens binary, so signature-based trust gave the attackers nothing to defeat; Huntress also tied some campaigns to malicious ChatGPT Custom GPTs that pointed victims at the ClickFix lure. Detection now hinges on spotting SiemensSoftwareCenter.exe running from AppData\Local\Programs and started by msiexec.exe.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-110936
Related: CVE-2026-110936: Siemens Software Center Uncontrolled Search Path Element Vulnerability Known Exploited Vulnerabilities · Oct 20, 2026
CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and Site Guard Flaws Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026