Siemens Software Center security flaw Exploited in ClickFix Malware Attacks

What happened

Attackers paired a genuine, signed copy of Siemens Software Center with malicious DLLs to infect Windows PCs via ClickFix (malware deployment method) lures. Siemens is a power plant technology and electrical engineering company based in Berlin.

ICS/OT Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks Attackers paired a genuine, signed copy of Siemens Software Center with malicious DLLs to infect Windows PCs via ClickFix lures. Siemens disclosed the flaw on October 15 in an advisory that assigned it a CVSS v4 score of 8.4.

Users who already have the application installed will receive the fix automatically the next time they launch it. The advisory didn’t mention in-the-wild exploitation until Monday, when Siemens added a link to a new blog post describing the attacks .

When the program started, it loaded the attacker-provided files from its own folder. Siemens Software Center handles the download, installation, activation and updating of software that customers have bought, and it can also be used to start free trials.

The vulnerability, tracked as CVE-2026-110936 (the public catalogue number for a specific software flaw) , exists because the program doesn’t properly restrict the locations it searches for DLL files. An authenticated local attacker could plant a malicious DLL in one of those folders and have their code executed with the same privileges as Software Center.

Two days later, the company updated the advisory to tell customers that version 4.0.9.8 resolves the issue. The attackers paired a legitimate copy of the Siemens program, which carried a valid digital signature, with malicious DLL files they supplied themselves.