Attackers exploit a Siemens Software Center DLL flaw in ClickFix campaigns to install a remote access trojan
The attackers paired a genuine, signed copy of the program with malicious DLLs. Siemens has fixed CVE-2026-110936 in version 4.0.9.8.
Evidence: Independent reports. Security stories run only with a named disclosure or independent reporting behind them.
Siemens said on Monday that threat actors have exploited a vulnerability in Siemens Software Center, the program customers use to download, install, activate and update Siemens software they have bought. The flaw, CVE-2026-110936, exists because the program does not properly restrict the folders it searches for DLL files. An authenticated local attacker can plant a malicious DLL in one of those folders and run code with the same privileges as Software Center. Siemens first disclosed the bug on October 15 with a CVSS v4 score of 8.4. Two days later it updated the advisory to say version 4.0.9.8 fixes the issue. Users who already have the application will receive the fix automatically the next time they launch it. The advisory did not mention exploitation until Monday, when Siemens added a link to a blog post describing the attacks. According to SecurityWeek, attackers bundled a legitimate, validly signed copy of the Siemens program with malicious DLLs. They used ClickFix lures, which trick users into running commands themselves, to infect Windows PCs. The Hacker News reports the campaign delivered a remote access trojan. Because the signed program loads the attacker's code, the malware can be harder to spot. Organizations that use Siemens industrial software should make sure Software Center has updated.