HighMalwareCVE-2026-110936
ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan
The Hacker News·Source published ·1 min read
What happened?
Siemens has addressed a DLL sideloading vulnerability impacting Siemens Software Center that it said has been exploited in ClickFix attacks. The high-severity vulnerability, tracked as CVE-2026-110936 (CVSS v4 score: 8.4), could allow an attacker to place a specially-crafted DLL in a directory the application searches, resulting in execution of malicious code with the same privileges as the
Key details
- The vulnerability lets an authenticated local attacker place a crafted DLL in a directory the application searches, leading to arbitrary code execution.
- Attackers used a signed copy of Siemens Software Center version 3.5.8.7 and placed a malicious archive.dll next to it to trigger code execution.
- The attack chain uses msiexec.exe to launch AllMyBasic.msi which then executes SiemensSoftwareCenter.exe.
- The activity is attributed to the Romulus ClickFix delivery platform detailed by Forescout.
- Malicious ChatGPT Custom GPTs directed victims to a fake URL serving a ClickFix lure that drops an MSI installer abusing DLL sideloading to deploy a remote access trojan.
- Siemens credited Huntress Labs researcher Jose Oregon for discovering and reporting the vulnerability.
Fixes and mitigations
- Update Siemens Software Center to version 4.0.9.8 or later and start the application to apply the update.
- Block the IP addresses and domains associated with the malicious activity.
What to look for
- Domain wizardexpensive.com used for payload hosting and command-and-control.
- SiemensSoftwareCenter.exe running from AppData\Local\Programs and started by msiexec.exe.
Summarised by SecOraLens from The Hacker News. Always read the original source before acting. How SecOraLens verifies advisories.