Skip to content
securitytabs

LiveUpdated

Siemens Software Center flaw exploited in ClickFix attacks; CISA adds it to KEV list

A flaw in Siemens Software Center, a Windows program used to install and update Siemens software, is being used in real attacks that install remote access malware. Organizations that use the program should install Siemens' update now.

Written by the SecurityTabs AI newsroom from 4 outlets, every paragraph cited; vulnerability scores come from NVD, FIRST and CISA, not the AI.

Business Action

What this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

Only organizations that use Siemens Software Center are affected. Siemens says the flaw is being exploited and has released an update. [1][2]

What to do

  1. Ask your IT provider whether Siemens Software Center is installed and whether it has been updated to the latest version. [2]
  2. Do not paste or run commands from web pages or messages you did not ask for, as ClickFix attacks rely on this. [1]

Mid-size company

A small IT or security team

What to know

Siemens recommends updating Software Center, and CISA lists the flaw as exploited, with a federal due date of November 3, 2026. [2][3]

What to do

  1. Find installations of Siemens Software Center and update those below V4.0.9.8 Update 1 to the latest version. [4][2]
  2. Use Siemens' blog post on detecting the exploitation to check for signs of compromise. [2]

Large enterprise

A security operations team

What to know

Siemens ties the exploitation to the Romulus ClickFix campaign, which delivers a remote access trojan. [5][1]

What to do

  1. Inventory Software Center versions across endpoints and deploy Siemens' update. [2][4]
  2. Apply the detection guidance in Siemens' blog post and hunt for suspicious DLL loads and remote access tooling on affected hosts. [2][1]

Vulnerabilities

What happened

The Hacker News reports that Siemens has addressed a DLL sideloading vulnerability in Siemens Software Center, tracked as CVE-2026-110936 and rated 8.4 on the CVSS v4 scale. DLL sideloading means the application loads a booby-trapped code library from a folder it searches, so an attacker who can place a crafted file there can run malicious code with the same privileges as the application. [1]

CISA's advisory describes the flaw as the application loading libraries from an uncontrolled search path, and says an authenticated local attacker could use it to run arbitrary code. Siemens has released a new version and recommends updating. The Canadian Centre for Cyber Security lists versions prior to V4.0.9.8 Update 1 as affected. [2][4]

Exploitation

Siemens says the flaw has been exploited in ClickFix attacks, a technique that tricks users into running malicious commands themselves. Infosecurity Magazine reports Siemens attributed the activity to the Romulus multi-platform ClickFix campaign, and that Siemens urged Software Center users to apply the update. The Hacker News says the attacks deploy a remote access trojan. [1][5]

CISA added CVE-2026-110936 to its Known Exploited Vulnerabilities (KEV) catalogue, its list of flaws attackers are using, on October 20, 2026, with a federal due date of November 3, 2026. CISA lists known ransomware use as unknown. Siemens has also published a blog post on how to detect the exploitation. [3][2]

What is not yet known

The sources reviewed do not say how many organizations were affected or who is behind the Romulus campaign beyond Siemens' attribution to it. [5]

Timeline

  1. CISA published an advisory on Siemens Software Center recommending the update. [2]

  2. CISA added the flaw to its KEV catalogue. [3]

  3. The Hacker News and Infosecurity Magazine reported ClickFix attacks exploiting the flaw. [1][5]

  4. Siemens published an advisory on active exploitation of CVE-2026-110936. [4]

Explained

The technology and terms in this story. Learn more

Why it was possible

The weaknesses behind this story's CVEs, from each CVE Record.

Sources

  1. [1]The Hacker News · Oct 20, 07:11 UTC
    ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojancontext
  2. [2]CISA Advisories · Oct 22, 12:00 UTC
    Siemens Software Centercontext
  3. [3]CISA Advisories · Oct 20, 12:00 UTC
    CISA Adds Six Known Exploited Vulnerabilities to Catalogcontext
  4. [4]Canadian Centre for Cyber Security · Oct 20, 19:57 UTC
    Siemens security advisory (AV26-1063) – Update 1context
  5. [5]Infosecurity Magazine · Oct 20, 10:45 UTC
    Siemens Customers Targeted by ClickFix Attackers Exploiting DLL Side-Loading Flawcontext