Siemens on Oct. 19 disclosed that attackers exploited a flaw in its Software Center product by spreading malware via a ClickFix attack.
The flaw — CVE-2026-110936 — loads dynamic-link libraries (DLLs) from an uncontrolled search path into the affected application.
According to the National Institute of Standards and Technology (NIST), this could let an authenticated local attacker place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.
The case dates back to Oct. 15, when Siemens disclosed the flaw and gave it a CVSS score of 8.4. Siemens updated its initial advisory on Oct. 17 and told customers that the updates in version 4.0.9.8 resolves the DLL bug.
Security pros were concerned about this incident because Siemens Software Center downloads, installs, activates and updates customers’ software and attackers were running the application with full privileges. The fear was that attackers could launch other DLL-sideloading attacks throughout the enterprise, as well as conduct lateral movement across the types of industrial environments that typically run Siemens products.
Justin Moore, director of adversary operations at Arctic Wolf, said the right response should include patch validation and compromise assessment. Moore said security teams should verify that the automatic update completed, but because attackers distributed a genuine Siemens executable alongside a malicious DLL outside official Siemens channels, defenders need to look for unexpected installations, suspicious execution from user-writable directories, MSI-driven launches, persistence mechanisms, and connections to the published infrastructure.
“A valid signature on the Siemens executable does not make the surrounding files or activity trustworthy,” said Moore.
John Strand, owner at Black Hills Information Security, explained that the issue with DLL sideloading is that a trusted executable can end up loading malicious code.
“You have a digitally signed Siemens executable that your security tools recognize and allow to run,” said Strand. “But the libraries it loads may not receive that same level of scrutiny.”
Strand, said it’s not exclusive to Siemens: we see this across vendors. The main executable is trusted, digitally signed, and allow-listed, but that trust can create a blind spot when it loads other libraries.
“A signature on the executable does not automatically make everything it loads safe,” said Strand. “That’s what makes this type of attack dangerous.”
Adrian Culley, offensive security engineer at SafeBreach, said while an automatic update to installed copies is welcome, teams need to understand that patch availability is not patch coverage, plus it says nothing about the older copies attackers carry with them.
So Culley said teams should confirm Software Center is at 4.0.9.8 or later, hunt with Siemens' published indicators and behaviors rather than hashes, limit who can run pasted commands from the Run dialogue or PowerShell, then test whether side-loading from user-writable paths raises an alert.
