Siemens has fixed a DLL sideloading flaw in Siemens Software Center after confirming that attackers were using the application itself as a delivery vehicle for a remote access trojan. The US cybersecurity agency added the flaw to its exploited-vulnerability list on 20 October.
What happened
Every build of Software Center before V4.0.9.8 loads helper libraries from its own program folder without checking what those files are. An attacker who can drop a file next to the executable gets code running with the same rights as the application, and because the executable carries a valid Siemens signature, endpoint tools treat the launch as legitimate.
Siemens describes the observed chain as a real copy of Software Center shipped alongside a crafted archive.dll, started through msiexec.exe running an installer named AllMyBasic.msi. That is the signature of a ClickFix lure: the victim is persuaded to paste and run a command that fixes a supposed browser or software error. Siemens attributes the delivery to a ClickFix platform called Romulus, and credits Huntress researcher Jose Oregon with finding the flaw.
The vulnerability is tracked as CVE-2026-110936, rated 8.4 under CVSS 4.0 and 6.7 under CVSS 3.1. CISA added it to the Known Exploited Vulnerabilities catalog on 20 October 2026, with a federal remediation deadline of 3 November 2026.
Who is affected
Any Windows machine carrying the affected builds, which in practice means engineering and maintenance workstations as much as office PCs, because Software Center is the download and update client for Siemens software.
- All Software Center versions below V4.0.9.8, on any Windows build.
- Machines where staff can run an MSI from their Downloads folder, since the chain starts with msiexec rather than with an exploit against a service.
- Industrial and OT-adjacent laptops that sit on the same network as control systems and are rarely rebuilt.
- Any host where SiemensSoftwareCenter.exe has run from AppData\Local\Programs in the last few weeks.
What to do now
Move Software Center to V4.0.9.8 or later, and treat any machine that ran an older build next to an unexpected archive.dll as compromised rather than merely unpatched. Updating is close to frictionless: existing installations pull the new version on next start, and a current installer can be downloaded directly.
- Open Software Center on each affected machine and let it self-update, or deploy the current build through your software management tool.
- Block 96.62.218.59, 2.27.248.127 and wizardexpensive.com at the firewall and DNS layer.
- Hunt for SiemensSoftwareCenter.exe executing from AppData\Local\Programs with msiexec.exe as the parent process.
- Review EDR telemetry for archive.dll or any unsigned DLL written beside a signed Siemens binary.
- Where the pattern is present, isolate the host, reset credentials used from it, and rebuild rather than clean.
What this means for South African businesses
The interesting part of this incident is not the flaw, which is a local privilege problem on its own, but the delivery: a signed application from a name engineers trust is doing the work that malware usually has to do for itself. In South African industrial settings the same copy of Software Center tends to live on the one laptop that also reaches the plant network, so a single successful ClickFix paste can put an attacker inside the segment that matters most.
My read is that most sites carrying this software will never see the malicious archive.dll, because the campaign depends on a user pasting a command. The cheaper control is therefore not another scanner but removing the habit and the rights that make pasted commands work.
The primary advisory for this flaw is Siemens security advisory SSA-580366.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.