Attackers exploit Siemens Software Center flaw CVE-2026-110936 in ClickFix malware campaign

Updated: 2026.10.20 19H ago 2 sources

Malware Zero-Days & CVEs Social Engineering & Phishing

Attackers abused a flaw in Siemens Software Center to help infect Windows PCs with malware. Siemens says the issue, CVE-2026-110936, is a DLL search-order hijacking bug in Software Center that let attacker-supplied files run when bundled with a legitimate signed copy of the app; version 4.0.9.8 fixes it, and Siemens linked observed exploitation to the Romulus ClickFix campaign, which uses fake prompts to trick users into running commands.

Why it matters: Organizations and users running Siemens Software Center on Windows should update immediately and watch for suspicious folders and behavior, not just known file hashes. The case also shows ClickFix operators are reusing trusted signed software to make malware delivery look legitimate.

Sources

ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan

info@thehackernews.com (The Hacker News) 2026.10.20 99% relevant

This article appears to cover the same underlying event: ClickFix operators exploiting Siemens Software Center flaw CVE-2026-110936 to deliver remote-access malware, adding reporting detail on the RAT payload and campaign framing.

Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks

Eduard Kovacs 2026.10.19 100% relevant

This article establishes a distinct story because it is Siemens' own disclosure of in-the-wild exploitation of CVE-2026-110936 in Siemens Software Center, tied to Romulus ClickFix, and no existing tracked story covers this specific Siemens vulnerability and campaign link.