Skip to main content
عربي
logo

NCSC-TAD-2610-001

Severity Level: Medium
Vulnerability

Reference No.: NCSC-TAD-2610-001CVSS 0

Attackers Exploit Siemens Software Center to Load Malicious DLLs

Threat Type:
N/A
TLP:
CLEAR
CVE:
CVE-2026-110936

Overview

Siemens has confirmed active exploitation of CVE-2026-110936, a DLL side-loading vulnerability in Siemens Software Center. Attackers distribute a legitimate, digitally signed executable alongside malicious DLL files. When launched, the vulnerable application loads these files, executing malicious code. Siemens associates this activity with the Romulus ClickFix campaign.

Affected Technologies

  • Siemens Software Center (Windows application).

Mitigation and Immediate Actions

  1. 01

    Update Siemens Software Center to version 4.0.9.8 or later.

  2. 02

    Only download Siemens software from official Siemens sources.

  3. 03

    Block the indicators: 96.62.218[.]59, wizardexpensive[.]com, and 2.27.248[.]127. Review historical logs for related connections.

  4. 04

    Investigate unexpected DLL files beside SiemensSoftwareCenter.exe, particularly outside its default installation folder.

  5. 05

    Monitor for the executable running from AppData\Local\Programs, launched by msiexec, or appearing unexpectedly in startup entries and scheduled tasks.

  6. 06

    Isolate systems showing signs of compromise and follow incident response procedures.

  7. 07

    Remind users never to paste commands into Run or PowerShell to complete CAPTCHA checks.

References