> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # ClickFix exploits Siemens Software Center DLL sideloading CVE-2026-110936 to deploy RAT - URL: https://f4n6.co.uk/security-feed/clickfix-exploits-siemens-software-center-dll-sideloading-cve-2026-110936-to-deploy-rat/ - Published: 2026-10-20T08:16:49.000Z - Updated: 2026-10-20T08:16:49.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-110936, ClickFix ## 1\. Executive summary Siemens has patched a DLL sideloading flaw in Siemens Software Center, tracked as CVE-2026-110936, which it says has been exploited in ClickFix attacks to deploy a remote access trojan. NVD scores the flaw 8.4 HIGH (CWE-427, uncontrolled search path); it is not in CISA KEV and EPSS records a 0% exploitation probability. The exploitation is confirmed by the vendor, not by the exploitation-probability feeds, so the low EPSS figure should not be read as evidence the flaw is unexploited. EMEA financial services firms running Siemens Software Center on engineering, OT-adjacent or admin workstations should treat the flaw as exploited in the wild and patch now. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------ | -------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 28 | A third-party vendor product (Siemens Software Center) carries an exploited DLL sideloading flaw, and the fix is a vendor update | Firms must confirm the Siemens update is applied across the estate and that the third-party dependency is tracked in the ICT third-party register | | NIS2 Art. 21(2)(d) | The attack path is a supply chain weakness in a vendor application's DLL search order | Supply chain security measures must cover the integrity of vendor software and its update channel | No other article in scope is engaged by the facts available. ## 3\. Technical analysis & attack chain The source is a short news item. It confirms the vulnerability class, the vendor fix and the ClickFix delivery context, and little else. The chain below is limited to what the source states; where a step is not described, it is marked as not stated rather than inferred. 1. Siemens Software Center searches a directory for a DLL as part of normal operation. 2. An attacker places a specially crafted DLL in a directory the application searches (CWE-427, uncontrolled search path). 3. The application loads the planted DLL, executing malicious code with the same privileges as the application. 4. The loaded code deploys a remote access trojan. The source does not name the affected Software Center versions, the specific directory searched, the DLL filename, the RAT family, or any command-and-control infrastructure. Those details are absent and should be obtained from the Siemens security advisory before scoping remediation. **Vulnerability mechanism.** CVE-2026-110936 is a DLL sideloading (search-order hijacking) flaw. The application resolves a DLL by name against a search path that includes a location an attacker can write to. Placing a malicious DLL of the expected name in that location causes it to load in place of the legitimate library. The source gives a CVSS v4 score of 8.4; NVD records 8.4 HIGH, which matches. NVD classifies the flaw as CWE-427. **Delivery.** The source attributes the exploitation to "ClickFix" attacks. ClickFix is a delivery technique in which a user is induced to paste and run a command, typically via a fake verification or error prompt. The source does not describe the specific lure, the pasted command, or how the DLL placement is achieved. Treat the ClickFix linkage as reported by the source and by Siemens; the mechanics are not detailed here. **Payload and impact.** The stated outcome is a remote access trojan. The source does not describe the RAT's capabilities, persistence mechanism, privilege escalation, lateral movement, or data access. No exfiltration or ransomware activity is reported. **Attribution.** "ClickFix" is a technique label, not a tracked threat actor, and it has no MITRE ATT&CK profile. Attribution to a specific group is unconfirmed. The source does not name an actor. **Confidence.** The vulnerability, its CVSS score, the vendor fix and the ClickFix exploitation claim rest on the source and Siemens. All technical specifics beyond that (versions, paths, DLL name, RAT identity, C2) are single-sourced at best and largely absent; verify against the Siemens advisory before acting on any indicator-level detail. ## 4\. Mitigation & containment ### P1 (within 24h) - Apply the Siemens Software Center update that addresses CVE-2026-110936\. Confirm the installed version against the Siemens advisory; the source does not state the fixed version number. - Identify every host running Siemens Software Center, prioritising engineering, OT-adjacent and administrative workstations, and confirm patch status. - Hunt for DLLs written to the Software Center install and search directories that do not match the vendor's signed binaries. Flag any unsigned or unexpected DLL in those paths for triage. ### P2 (within 72h) - Restrict write access to the Software Center installation directory and any user-writable directory on its DLL search path, so standard users cannot drop libraries there. - Enable DLL search-order hardening where the application supports it, and audit the effective search path on a sample of hosts. - Review endpoint telemetry for Software Center spawning child processes or making outbound connections it does not normally make, consistent with a loaded RAT. ### P3 (within 7 days) - Add the Software Center install path to application control or allow-listing so only signed vendor DLLs load from it. - Brief users on ClickFix-style lures (paste-and-run prompts) and block clipboard-to-run patterns at the endpoint where policy allows. - Record the Siemens dependency and its patch cadence in the ICT third-party register (see DORA Art. 28). ## 5\. Indicators of compromise No indicators of compromise available in the source material. The source gives no hashes, filenames, paths, domains, IP addresses or registry keys. The affected Software Center versions and the RAT identity are also not stated. ## 6\. Detection Insufficient indicators to author detection rules. The source provides no distinctive strings, filenames, paths, command lines, registry keys or network artefacts to build a rule from. Detection should be based on the Siemens advisory once its technical detail is available, and on the behavioural hunting described in section 4 (unexpected DLLs in the Software Center search path, anomalous child processes and outbound connections from the application). ## CVE assessment 1 referenced CVE | CVE | CVSS | Exploited | EPSS | Summary | | ---------------------------------------------------------------------------------- | -------- | --------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-110936](https://nvd.nist.gov/vuln/detail/CVE-2026-110936?ref=f4n6.co.uk) | 8.4 High | — | 0% | A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynami… | ## 7\. Sources - The Hacker News, "ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan", https://thehackernews.com/2026/10/clickfix-attackers-exploit-siemens.html, 2026-10-20. - NVD, CVE-2026-110936 (CVSS 8.4 HIGH, CWE-427), https://nvd.nist.gov/vuln/detail/CVE-2026-110936. - CISA KEV catalog (CVE-2026-110936 not listed), https://www.cisa.gov/known-exploited-vulnerabilities-catalog. - EPSS (CVE-2026-110936, 0%), https://www.first.org/epss. ## 8\. Adverse Trace position Adverse Trace assesses CVE-2026-110936 as 8.4 HIGH per NVD, not in CISA KEV, with EPSS at 0%, but the vendor reports active exploitation in ClickFix attacks, so the exploitation-probability feeds understate current risk and the patch should be treated as urgent for any host running Siemens Software Center. Client impact is concentrated on engineering and OT-adjacent workstations where this software is typically installed; the RAT outcome means a successful load gives an attacker a foothold on those hosts. Attribution to a named actor is unconfirmed, and the technical detail needed for indicator-level detection is not in the source. We will obtain the Siemens security advisory to recover the affected and fixed versions, the searched directory and the DLL name, and will issue an update with concrete detection content once that detail is available. Clients should confirm their Software Center inventory and patch status in the meantime. --- [Read the original source →](https://thehackernews.com/2026/10/clickfix-attackers-exploit-siemens.html?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*