ClickFix Attacks Used Siemens Software Center DLL Flaw, Report Says
Siemens has fixed a DLL sideloading vulnerability in Software Center that it says was exploited in ClickFix attacks to deliver a remote access trojan, according to The Hacker News.
Siemens has addressed a DLL sideloading vulnerability in its Software Center that the company says was exploited in ClickFix attacks to deploy a remote access trojan, The Hacker News reported on Oct. 20, 2026.
The flaw, tracked as CVE-2026-110936, carries a CVSS v4 score of 8.4, which the report describes as high severity. According to the report, it lets an attacker place a specially crafted DLL in a directory the application searches, so the malicious code runs with the same privileges as the affected application.
The underlying weakness is an uncontrolled search path element. In plain terms, the software loads a library from a location an attacker can influence, and the application trusts whatever it finds there. That is the mechanism ClickFix campaigns are said to have used here.
The report does not detail the ClickFix lures, the trojan involved, or who was targeted, so those specifics remain unconfirmed.
What defenders can do
- Confirm which Software Center builds are in use and apply Siemens' fix per its advisory.
- Treat unexpected DLLs in application directories as suspicious and review endpoint telemetry for unusual library loads.
- Watch for ClickFix-style social engineering, which typically tricks users into running commands themselves.
The report does not say whether exploitation was widespread or targeted.
CVE references
Sources
- ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access TrojanPrimarythehackernews.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning