Siemens has confirmed the exploitation of vulnerability CVE-2026-110936 within its Software Center application. The flaw, which received a CVSS 4.0 score of 8.4, allowed local users with authenticated access to execute arbitrary code by placing malicious DLL files in specific directories. The company released a fix in version 4.0.9.8 on October 17, which is applied automatically upon application startup.
The attacks involved using a legitimate, digitally signed version of the Siemens Software Center alongside malicious DLLs. Siemens clarified that its own software, products, and update channels were not compromised. The company is currently sharing indicators of compromise with law enforcement and EDR providers to assist in detection and response efforts.
The incidents are linked to the Romulus platform, which utilizes ClickFix tactics to trick users into executing malicious commands via fake CAPTCHA prompts. Romulus has previously been observed distributing the LegionLoader malware. While the identity of the operators behind Romulus remains unknown, the methodology aligns with recent campaigns involving other software vendors like Canon and Stardock.
