ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan
ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan
Ravie Lakshmanan Oct 20, 2026 Vulnerability / Endpoint Security Siemens has addressed a DLL sideloading vulnerability impacting Siemens Software Center that it said has been exploited in ClickFix attacks. The high-severity vulnerability, tracked as CVE-2026-110936 (CVSS v4 score: 8.4), could allow an attacker to place a specially-crafted DLL in a directory the application searches, resulting…
Vulnerabilities mentionedAll →
- CVE-2026-1109368.4<1%DLL Search-Path Hijacking in Siemens Software Centerpublished · Siemens Software Center KEV
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-110936 | DLL Search-Path Hijacking in Siemens Software Center Siemens Software Center, in all versions, loads dynamic-link libraries from an uncontrolled search path (CWE-427). An authenticated local attacker who already has high privileges can place a crafted DLL in a directory the application searches, so the program loads that library. Successful exploitation runs arbitrary code with the privileges of Siemens Software Center and can fully compromise confidentiality, integrity, and availability on that system. The issue is local only: it requires high privileges, no user interaction, and does not extend impact to other systems under the published CVSS 4.0 score of 8.4. It is not listed in CISA KEV, and no public proof-of-concept is known. |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | wizardexpensive.com | 96.62.218[.]59 (Payloading hosting and command-and-control) wizardexpensive[.]com (Payloading hosting and command-and-control) 2.27.248[.]1 |
Full article403 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananOct 20, 2026Vulnerability / Endpoint Security
Siemens has addressed a DLL sideloading vulnerability impacting Siemens Software Center that it said has been exploited in ClickFix attacks.
The high-severity vulnerability, tracked as CVE-2026-110936 (CVSS v4 score: 8.4), could allow an attacker to place a specially-crafted DLL in a directory the application searches, resulting in execution of malicious code with the same privileges as the affected service.
"The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path," Siemens said in an advisory. "This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application."
The issue has been patched in version 4.0.9.8. Huntress Labs researcher Jose Oregon has been credited with discovering and reporting the shortcoming.
In a separate alert, Siemens said attackers have abused a genuine copy of Siemens Software Center with a valid signature and placed their own crafted DLL ("archive.dll") next to it to trigger the execution of malicious code.
"They chose this program as a carrier because it is signed and trusted, and because version 3.5.8.7, the latest version at the time, loaded helper files from its own folder without checking them," Siemens added.
Specifically, threat actors have been found leveraging "msiexec.exe" to launch "AllMyBasic.msi," which then executes "SiemensSoftwareCenter.exe." The activity has been attributed to a ClickFix delivery platform called Romulus, which was detailed by Forescout last week as being used to deliver Legion Loader and other malware using DLL sideloading.
According to Huntress, some of these campaigns have leveraged malicious ChatGPT Custom GPTs to direct victims to a fake URL responsible for serving a ClickFix lure, which when copied and executed by the victim, runs PowerShell code to drop an MSI installer that abuses DLL sideloading to ultimately deploy a remote access trojan.
Siemens has shared the following indicators of compromise -
- 96.62.218[.]59 (Payloading hosting and command-and-control)
- wizardexpensive[.]com (Payloading hosting and command-and-control)
- 2.27.248[.]127 (Distribution channel of AllMyBasic.msi)
Besides updating Siemens Software Center to version 4.0.9.8 or later and starting the application to apply the update, organizations are advised to block the IP addresses and domains associated with the malicious activity and look for "SiemensSoftwareCenter.exe" running from "AppData\Local\Programs" and started by "msiexec.exe."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.