Attackers Abuse Trusted Siemens Software to Slip a Remote Access Trojan Past Defences

Siemens has fixed a high-severity vulnerability in its Siemens Software Center, tracked as CVE-2026-110936 (CVSS v4 score: 8.4). The flaw lets the application load files from an uncontrolled search path. An attacker could place a specially crafted DLL file where the program looks for it, and the malicious code would then run with the same privileges as the application. Siemens fixed the issue in version 4.0.9.8, and Huntress Labs researcher Jose Oregon was credited with reporting it.

In a separate alert, Siemens said attackers have already abused this weakness. They used a genuine, validly signed copy of Software Center and placed their own DLL ("archive.dll") beside it. Siemens said the program made an attractive carrier because it is signed and trusted, and because version 3.5.8.7 loaded helper files from its own folder without checking them. The activity has been linked to a ClickFix delivery platform called Romulus, which Forescout described last week as delivering Legion Loader and other malware.

According to Huntress, some campaigns used malicious ChatGPT Custom GPTs to send victims to a fake web address with a ClickFix lure. When the victim copies and runs the supplied command, PowerShell drops an MSI installer that uses DLL sideloading to deploy a remote access trojan. Siemens advises updating to version 4.0.9.8 or later and starting the application to apply the update. It also recommends blocking the malicious IP addresses and domains it has published, and checking for SiemensSoftwareCenter.exe running from AppData\Local\Programs and started by msiexec.exe.