Siemens Patched a Flaw Attackers Were Already Using to Slip in a Trojan

Emily Davis · 2026-10-20

Siemens just fixed a security hole in its Software Center, and the timing matters. The company confirmed the flaw was already being used in real-world ClickFix attacks, which means this wasn't a theoretical risk sitting in a lab. People were actually getting hit. The vulnerability is tracked as CVE-2026-110936, and it carries a CVSS v4 score of 8.4. That's high severity, the kind that should make you sit up a little straighter if Siemens Software Center lives anywhere on your machines. ### What's Actually Going Wrong At the heart of this is something called DLL sideloading. Sounds technical, but the idea is simple. Windows applications load supporting files called DLLs from certain directories when they start up. If an attacker can drop a malicious DLL into one of those folders, the app will happily load it, thinking it's legitimate. The result? Malicious code runs with the same privileges as the application itself. If that app has admin rights, well, you can guess how that ends. Here's the uncomfortable part: the attacker doesn't need to break down the front door. They just need to leave a file in the right place and wait for the app to pick it up. It's quiet, it's sneaky, and it works. ### How ClickFix Fits In ClickFix is a technique that's been gaining traction. It tricks users into running commands themselves, usually through fake error messages or CAPTCHA prompts that tell you to "fix" something by pasting a command into a terminal. Once that command runs, the attacker has a foothold. Pair that with a DLL sideloading flaw, and you've got a path to deploying a remote access trojan. That's the payload here, and it's a nasty one. A RAT gives an attacker ongoing access to a machine, letting them watch, steal, and move around your network. > The scariest vulnerabilities aren't the ones that break in loudly. They're the ones that convince you to open the door yourself. ### What You Should Do Now If you use Siemens Software Center, don't wait. Here's the short list: - Update to the patched version Siemens released as soon as you can - Check whether any of your endpoints show signs of unusual DLL activity in application folders - Review who has local admin rights, since that's what makes this flaw so dangerous - Watch for ClickFix-style prompts that ask users to paste commands into a terminal - Brief your team on the fake "fix it" messages that drive these attacks ### The Bigger Picture This isn't just about one Siemens product. DLL sideloading keeps showing up because it exploits how Windows works, not a single coding mistake. Attackers love it because it blends in. The app looks like it's doing its normal job. For anyone managing endpoints, the lesson is familiar but worth repeating. Patch fast, limit privileges, and treat user-facing prompts with suspicion. A trojan doesn't need to be clever if it can ride in on trust. Siemens did its part by shipping a fix. Now it's on the rest of us to actually apply it before someone else finds the door still open.