8.4 Severity: Siemens Software Center Flaw Used in ClickFix RAT Campaigns

Siemens Software Center installations running versions older than 4.0.9.8 are currently exposed to active exploitation involving remote access trojans. The Canadian Centre for Cyber Security issued advisory AV26-1063 on October 19, 2026, warning that the flaw, tracked as CVE-2026-110936, has been abused in the wild since October 15, 2026. This vulnerability carries a high severity rating of 8.4 on the CVSS v4 scale.

What is the technical nature of the vulnerability?

The flaw is a DLL sideloading issue where the application loads dynamic-link libraries from an uncontrolled search path. According to Siemens, an authenticated local attacker can place a crafted DLL in a directory the application searches. This results in arbitrary code execution with the same privileges as the affected service. The vendor addressed the issue in version 4.0.9.8, which is available for users to apply.

How are attackers exploiting this flaw in the wild?

Threat actors are leveraging a genuine, signed copy of Siemens Software Center as a carrier for malware. They place a malicious file named "archive.dll" next to the legitimate executable to trigger code execution. Siemens noted that version 3.5.8.7 loaded helper files from its own folder without verification, making it an attractive target for this technique.

What is the infection chain and attribution?

Huntress Labs researcher Jose Oregon discovered and reported the shortcoming. Attackers use the Romulus delivery platform, previously detailed by Forescout, to distribute Legion Loader and other malware. Some campaigns involve malicious ChatGPT Custom GPTs directing victims to fake URLs. These sites serve a ClickFix lure that executes PowerShell code to drop an MSI installer, which then abuses the DLL sideloading flaw.

What specific indicators should defenders monitor?

Siemens shared several indicators of compromise related to this campaign. These include the IP address 96.62.218.59, used for payload hosting and command-and-control. Another domain, wizardexpensive.com, serves the same purpose. Additionally, the IP address 2.27.248.127 acts as a distribution channel for the malicious AllMyBasic.msi installer. Teams should block these domains and IPs to mitigate exposure.

Detection notes

Security teams should monitor for unexpected DLL loading by legitimate applications, particularly those from trusted vendors like Siemens. Look for processes spawning from MSI installers that do not align with standard patching activities. Check file system logs for new DLL files appearing in application directories shortly before execution. Investigate any PowerShell scripts triggered by user interactions with external links or chat interfaces. Verify that applications are loading libraries from expected, secure paths rather than adjacent folders.

Background: Remote access trojans

A remote access trojan is malware that grants unauthorized users full control of your device. It disguises itself as useful software, allowing attackers to steal data, record activity, and move laterally through networks. Detection requires monitoring for unusual outbound connections and validating all software sources.

Read the full guide: Remote Access Trojans: Definition, Mechanics, and Risk Reduction

What to do and how to stay safe: Siemens

• Update Siemens Software Center to version 4.0.9.8 or later to patch the DLL sideloading vulnerability.
• Monitor network traffic for connections to known malicious IPs and domains associated with the ClickFix campaign.
• Review file integrity logs for unexpected DLL files placed in application directories by local users.
• Educate users to avoid executing files or following links provided by unverified AI chat interfaces or custom GPTs.

Step-by-step guide: Patch Management Checklist: Secure Systems Without Breaking Them

General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Siemens Software Center are vulnerable?

Versions prior to 4.0.9.8 are affected by CVE-2026-110936, with version 3.5.8.7 specifically noted as being targeted due to its file loading behavior.

Is there a confirmed fix for this vulnerability?

Yes, Siemens has released version 4.0.9.8, which addresses the DLL sideloading vulnerability and prevents the exploitation described in the advisory.

Who discovered this vulnerability?

Huntress Labs researcher Jose Oregon is credited with discovering and reporting the shortcoming to Siemens before it was publicly disclosed.