Summary
- CVE-2026-110936 is a DLL sideloading vulnerability in Siemens Software Center, rated CVSS v4 8.4 (high severity).
- Attackers can place a malicious DLL in a directory the application searches, executing code with the same privileges as the application.
- The vulnerability has been exploited in active ClickFix campaigns to deliver remote access trojans (RATs).
- Siemens has released a patch addressing the vulnerability.
- Organisations running Siemens Software Center should prioritise patching and review endpoint telemetry for signs of DLL sideloading activity.
What Has Happened
Siemens has patched a DLL sideloading vulnerability in its Software Center product after confirming the flaw has been exploited in the wild. Tracked as CVE-2026-110936 and carrying a CVSS v4 score of 8.4, the vulnerability allows an attacker to place a specially crafted DLL file in a directory the application searches during execution. When the application loads that file, the malicious code runs with the same privileges the Siemens Software Center process holds — no privilege escalation required.
The ClickFix Connection
The exploitation has been observed as part of ClickFix attacks. ClickFix is a social engineering technique that manipulates users into executing malicious commands or scripts — typically by presenting a fake error or CAPTCHA prompt that instructs the victim to run something on their machine. In this campaign, the technique has been used as the delivery mechanism for a remote access trojan (RAT), meaning successful exploitation gives an attacker persistent remote control over the compromised endpoint.
Why DLL Sideloading Remains Effective
DLL sideloading exploits the way Windows applications resolve and load dynamic-link libraries. When a legitimate, trusted application searches for a DLL in a predictable or user-writable directory before checking the correct system path, an attacker who can write to that directory can substitute their own malicious file. Because the malicious code runs under the cover of a legitimate, trusted process, it can bypass application allowlisting controls and evade detection tools that focus on process reputation rather than file integrity.
Siemens Software Center in Context
Siemens Software Center is a software management and distribution tool used in industrial and enterprise environments. Its presence in operational technology adjacent networks makes exploitation particularly sensitive. A RAT deployed in such an environment could afford an attacker visibility into, and potentially control over, systems that sit close to — or within — industrial control infrastructure. The sources do not specify which versions are affected beyond confirming that a patch has been issued.
Current Patch Status
Siemens has addressed the vulnerability. Organisations should consult Siemens’ official security advisory for specific version information and patch guidance. The sources do not detail workarounds beyond applying the patch.
Why it matters
For CISOs, this incident illustrates how a trusted vendor tool — deployed precisely because it is authorised software — can become the pivot point for a RAT deployment. Siemens Software Center likely exists on approved application lists in many industrial and enterprise environments, which means the malicious DLL may have run without triggering standard controls. Combined with ClickFix’s reliance on user action rather than remote code execution, the attack chain has a low technical barrier: it requires only that an attacker position a file and convince a user to trigger the right interaction. Environments with OT adjacency should treat RAT deployment on any endpoint with heightened urgency given lateral movement potential.
What to do now
- Apply Siemens’ patch for CVE-2026-110936 as soon as operationally feasible and verify the updated version is deployed across all instances of Siemens Software Center.
- Review endpoint detection telemetry for DLL sideloading indicators, particularly unusual DLLs loaded by Siemens Software Center processes.
- Investigate any endpoints running Siemens Software Center for signs of RAT activity, including unexpected outbound connections or new scheduled tasks.
- Brief relevant staff — particularly those in OT-adjacent or engineering roles who use Siemens tooling — on ClickFix social engineering tactics and how to recognise fake error or CAPTCHA prompts.
- Assess directory permissions for the Siemens Software Center installation paths to confirm no unauthorised write access exists in the directories the application searches for DLLs.
