Siemens Software Center Flaw Exploited in ClickFix Attacks
A high-severity DLL sideloading flaw in Siemens Software Center has been actively exploited by attackers to deploy remote access trojans. Organizations using the platform should apply updates immediately.
TL;DR
- Attackers used CVE-2026-110936 to deploy RATs via Siemens Software Center.
- The vulnerability involves DLL sideloading with a CVSS v4 score of 8.4.
- Siemens has released patches to address the issue.
- Organizations should audit systems for unauthorized DLLs.
- Endpoint detection and response tools can help identify exploitation.
Cybercriminals behind the ClickFix campaign have been exploiting a high-severity vulnerability in Siemens Software Center to deploy remote access trojans. The flaw, identified as CVE-2026-110936, allows attackers to execute arbitrary code through DLL sideloading techniques.
Siemens has confirmed active exploitation and recommends immediate patching. The vulnerability carries a CVSS v4 severity score of 8.4, indicating significant risk to impacted organizations. Companies relying on Siemens Software Center should prioritize remediation efforts.
Vulnerability Details
- CVE-2026-110936 is a DLL sideloading vulnerability affecting Siemens Software Center
- Attackers can place malicious DLL files in directories searched by the application
- Successful exploitation leads to code execution with the same privileges as the application
- The flaw received a CVSS v4 base score of 8.4 (High severity)
- Siemens released patches to resolve the issue following confirmation of active exploitation
Detection and Mitigation
- Organizations should apply Siemens-provided security updates immediately
- Security teams should monitor for unexpected DLL file placements in application directories
- Deploy endpoint detection and response solutions to identify suspicious process behaviors
- Network monitoring can help detect command-and-control communications from deployed trojans
- Conduct thorough system audits to identify potential compromise indicators
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.