Siemens patches Software Center flaw after ClickFix crews abuse it

Key points - Siemens fixed a DLL-loading flaw in Siemens Software Center, tracked as CVE-2026-110936 and rated 8.4 out of 10, published on 15 October 2026. - The flaw affects every version of Siemens Software Center below V4.0.9.8 and lets an attacker already on the machine run code with the application's privileges. - Attackers are chaining it with ClickFix lures, a social-engineering trick that gets a user to paste a command that quietly plants a malicious file. - Siemens recommends updating to V4.0.9.8 or later; there is no workaround that leaves the tool fully functional. - Threat Vectr's own leak-site tracking hasn't seen a ransomware crew claim victims through this bug, but ClickFix activity is widely linked to initial-access brokers.

Siemens has shipped a fix for a bug in Siemens Software Center, the small desktop tool engineers use to install and update Siemens industrial software. An attacker already signed in to a Windows machine can trick the tool into loading a booby-trapped file and run their own code with the tool's privileges.

The vulnerability is CVE-2026-110936, published on 15 October 2026, scored 8.4 on the 10-point severity scale. It affects every version of the tool below V4.0.9.8.

The application looks for helper files, called DLLs, in a list of folders without checking carefully enough where they came from. Drop a malicious DLL into one of those folders and the Siemens tool loads it the next time it runs. That's what security researchers mean by "DLL sideloading", and it's a technique Threat Vectr has been tracking since June.

How are attackers actually using it?

Through ClickFix. It's a social-engineering playbook where a website or email tells the user something is broken and offers a one-click "fix": copy this text, paste it into the Windows Run box, press Enter. The pasted command quietly downloads the attacker's DLL into a folder the Siemens tool reads from. Next time Software Center opens, the malicious file runs.

The Hacker News reports the payload in current campaigns is a remote access trojan, software that gives the attacker a hidden back door into the machine. Because the Siemens tool often runs on engineering workstations with access to industrial networks, that back door is worth considerably more than it would be on a standard laptop. We covered a ClickFix variant that had learned to fingerprint researchers' browsers in our 21 September story, which shows how fast this playbook is evolving.

Who is affected and what should they do?

Anyone running Siemens Software Center below V4.0.9.8. Siemens' advice is direct: update to V4.0.9.8 or later. There's no clean workaround.

Two practical steps matter more than the patch note itself. Push the update through your software distribution system rather than waiting for engineers to click it, because the people most likely to fall for a ClickFix prompt are often the same people who postpone updates. Then check recent PowerShell and Run-dialog history on machines where Software Center is installed, looking for pasted commands that write files into the tool's install path or user AppData folders.

Ordinary office staff aren't the target here. The engineer with Siemens software on their machine and a route into a plant network is. That's the judgement call worth making internally: this is an 8.4-out-of-10 bug on paper and a bigger problem in practice, because of who gets hit and what sits on the other side of their VPN.

Treat the ClickFix angle as the real story. The DLL flaw is the lockpick; the lie on the webpage is the hand holding it.