Siemens has announced that malicious actors are exploiting a vulnerability in the Siemens Software Center application as part of a widespread malware campaign. The aforementioned application is used to manage the downloading, installation, activation, and updating of software purchased by customers, as well as to initiate free trial periods.
The vulnerability carries the identifier CVE-2026-110936, and its details were published in a security advisory issued by the company, where it received a severity score of 8.4 according to the CVSS v4 scale. The issue lies in the program's failure to properly restrict the locations where it searches for Dynamic Link Library (DLL) files, which allows an authenticated local attacker to plant a malicious file and execute code with the same privileges as the application.
Context of Attacks Linked to the Romulus Campaign
Siemens linked these attacks to an operation known as "Romulus," a cross-platform ClickFix attack platform that relies on deceptive messages, such as fake verification tests, to trick users into copying and pasting malicious commands onto their personal devices. Research from security firms such as Forescout and Huntress indicated that this platform was deployed on multiple servers used to distribute malicious packages that rely on DLL side-loading in digitally signed applications from various vendors.
Siemens confirmed that its software has not been tampered with and that the malicious package was not distributed through its official distribution channels, noting that no system or product belonging to it has been compromised. The company released version 4.0.9.8 to address the vulnerability, which reaches users automatically the next time the application is launched.
What changes practically for users and defenders?
- Automatic update: Users who have the application installed will receive the security fix automatically when opening the program.
- Change in defense strategy: Since the Siemens files used in the attacks are legitimate and properly signed, the company recommends focusing on suspicious behavior and malware folders rather than relying exclusively on file hashes.
- Security collaboration: Siemens is sharing Indicators of Compromise (IoCs) with relevant authorities and third-party Endpoint Detection and Response (EDR) providers.