Siemens Warns Attackers Are Abusing Software Center Flaw in Fake Verification Scam

Siemens has warned customers that attackers are actively exploiting a vulnerability in its Software Center to distribute malware. The flaw, tracked as CVE-2026-110936 (CVSS 8.4), is a DLL side-loading issue. Version 3.5.8.7 loaded helper files from its own folder without checking them. Attackers use a genuine, validly signed copy of the application and place their own malicious files beside it. Siemens attributes the activity to the Romulus multi-platform ClickFix campaign.

Romulus is a server hosting panel identified by Forescout researchers on October 14. It lets cybercriminals run ClickFix tactics across a whole ecosystem and deliver multiple kinds of malware. ClickFix is a social engineering technique that tricks people into running attacker-supplied commands on their own machine. If a user follows the lure, malicious code runs with the privileges of the affected application. Siemens advised: "Never paste a command from a web page into Win+R, the Run box or PowerShell. A real 'I am not a robot' check never asks for this."

Siemens urges customers to update to Software Center version 4.0.9.8, which fixes the flaw; existing installations update automatically at next start. If a PC is compromised, isolate it, stop the process, remove the start-up entry and task, and reset passwords. Because the Siemens file is genuine, detection should focus on the folder and suspicious behaviour, not the file fingerprint. Customers should download Siemens software only from official sources and block the IP address and domain listed in the advisory.