Siemens Software Center Vulnerability Exploited in ClickFix Malware Campaign
Hackers are exploiting a DLL side-loading vulnerability in Siemens Software Center using ClickFix social engineering lures to infect Windows computers.
FTMQ Security, written by our newsroom0 views
Siemens disclosed on Monday that attackers are actively exploiting a vulnerability in Siemens Software Center in the wild, SecurityWeek reported. The flaw is tracked as CVE-2026-110936 and involves a DLL side-loading vulnerability. Attackers are using this vulnerability alongside ClickFix social engineering lures to infect Windows personal computers. [1]
SecurityWeek reported that attackers pair a genuine, signed copy of the Siemens Software Center application with malicious DLL files. The vulnerability occurs because the software does not properly restrict the file locations it searches for DLL files. An authenticated local attacker can plant a malicious DLL file in one of these directories to execute the attack. [1]
Siemens Software Center is designed to handle the download, installation, activation, and updating of software purchased by customers, and it also manages free trials. ClickFix is a social engineering technique that displays a popup over a webpage to instruct users to execute system commands, often by prompting them to open the Microsoft Windows Run dialog using keyboard shortcuts. [1][3]
In short
- Siemens confirmed in-the-wild exploitation of CVE-2026-110936 in Siemens Software Center.
- The vulnerability allows DLL side-loading because the software fails to properly restrict DLL search locations.
- Attackers rely on ClickFix social engineering lures to deploy malicious DLLs alongside signed Siemens software.
Sources
Every paragraph above points to the numbered items it rests on. Read the originals here.
- [1]Siemens Software Center Vulnerability Exploited in ClickFix Malware AttacksSecurityWeek, 7h ago (the report this story comes from)
Background
Our newsroom writes these reports with the help of software, from the 3 sources listed and nothing else, and checks them against those sources. Facts can still be wrong or move on; the originals are the record. Spotted a mistake? Write to daniel@monsterkong.com.
Related from FTMQ Security
Earlier reports of ours on the same people and subjects.
- SonicWall SMA 1000 Appliances Target of Critical Vulnerability Exploitation AttemptsTop Stories, 7d ago
- AvisLoader Windows Malware Uses Peer to Peer Network to Resist DisruptionThreat Intelligence, 7d ago
- Iranian Hackers Target Iraqi Infrastructure with Fake Recruitment LuresThreat Intelligence, 13d ago
More in Top Stories
- Hackers claim theft of data from State Bank of India customers2h ago
- iRhythm Technologies confirms June data breach impacted 8 point 2 million individuals2h ago
- Rank Math PRO WordPress plugin compromised in supply chain attack2h ago
- MITRE Releases ATT&CK Version 20 Addressing AI Abuse and Infrastructure Attacks15h ago
- October Windows Server updates break Exchange sign in and mail flow15h ago
- AdFection Campaign Uses Malicious Online Ads to Deliver Candiru Spyware2d ago
Get the day in one email
Reports like this one, the top news of the last 24 hours, every morning. Free, one email a day; readers can comment under every report.
By signing up you agree to our terms and privacy policy. Unsubscribe any time.
Comments
Loading
Join the conversation
Comments are open to readers of our daily email: the top news of the last 24 hours, every morning, free. Sign up and the comment box opens.
Already on the list? Enter the same address and we will send a sign-in link.
By signing up you agree to our terms and privacy policy. Unsubscribe any time.