Siemens Software Center DLL Sideloading Enables ClickFix RAT Deployment
Attackers abused a signed Siemens installer to load malicious code via CVE-2026-110936, achieving high-privilege execution on victim systems.
Key points
- Active exploitation of CVE-2026-110936 was reported by Siemens on October 15, 2026.
- The flaw allows arbitrary code execution with the privileges of the affected application.
- A patch is available in Siemens Software Center version 4.0.9.8.
Attackers gained remote access to victim systems by leveraging a flaw in Siemens Software Center. They needed only to place a crafted dynamic-link library in a directory monitored by the application. This allowed them to execute malicious code with the same privileges as the legitimate software service, bypassing standard security controls.
How it unfolded
- On October 15, 2026, Siemens reported that CVE-2026-110936 was being exploited in the wild.
- The Canadian Centre for Cyber Security issued advisory AV26-1063 on October 19, 2026.
- Huntress Labs researcher Jose Oregon discovered and reported the vulnerability to Siemens.
Who is affected
Organizations using Siemens Software Center versions prior to 4.0.9.8 are vulnerable. According to The Hacker News, the high-severity flaw has a CVSS v4 score of 8.4. Attackers targeted systems where the application loaded libraries from an uncontrolled search path.
The fix
Siemens has addressed the issue in version 4.0.9.8. The vendor stated that the update resolves the DLL sideloading vulnerability. Users are encouraged to apply the update as soon as possible to prevent unauthorized code execution.
What made it possible
Teams usually encounter this class of weakness when applications trust local file paths without validation. The technique relies on the operating system’s library search order, allowing an attacker to substitute a legitimate file with a malicious one. This method serves the initial compromise stage, granting immediate execution rights.
Administrators should check whether critical services run with elevated privileges and verify that installation directories are strictly controlled. Ensuring that applications do not load components from writable locations reduces the risk of this specific intrusion vector. Regular audits of file permissions in application folders can help identify misconfigurations before they are abused.
What to do and how to stay safe: Siemens
- Verify the installed version of Siemens Software Center against the vendor's advisory.
- Monitor for unexpected DLL files in application directories or recent MSI installations.
- Check for connections to known command-and-control indicators provided by Siemens.
- Review PowerShell execution logs for signs of remote script deployment.
Step-by-step guide: What Is Virtual Patching: How It Works Without Code Changes
General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVE ID for this Siemens flaw?
The vulnerability is tracked as CVE-2026-110936.
Which version fixes the issue?
Siemens Software Center version 4.0.9.8 contains the fix.
How did attackers deliver the malware?
They used a ClickFix delivery platform called Romulus to deploy a remote access trojan.
