ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan

Siemens has patched a high-severity DLL sideloading vulnerability in Siemens Software Center, tracked as CVE-2026-110936 with a CVSS v4 score of 8.4. The flaw allows attackers to place a specially-crafted DLL in a directory searched by the application, resulting in execution of malicious code with the application's privileges. The vulnerability has been actively exploited in ClickFix attacks to deploy a Remote Access Trojan (RAT). ClickFix is a social engineering technique that tricks users into executing malicious commands. The exploitation of a legitimate industrial software platform like Siemens Software Center raises significant concerns for operational technology and critical infrastructure environments. Siemens has addressed the vulnerability and users are advised to apply patches promptly.