Critical Known exploited Patch available CVSS 8.4
Siemens fixes Software Center flaw already used in attacks
The Hacker NewsSiemensCVE-2026-110936
What happened. Siemens fixed a DLL sideloading flaw (CVE-2026-110936, CVSS v4 8.4) in Siemens Software Center. An attacker could place a crafted DLL where the application searches and run malicious code. Siemens said it has been exploited in ClickFix attacks.
Who is affected. Users of Siemens Software Center. The source does not name versions or sectors.
What to do. Check whether you run Siemens Software Center and apply the Siemens fix.
Editor's reading
Forasset ownerIT security
- Purdue level
- L4
- L2
Why: Software Center is a desktop application, so it sits on engineering workstations (L2) or office PCs (L4), and ClickFix lures target the person at the keyboard.
- Are you exposed?
Search your asset inventory for Siemens Software Center installs and compare the installed version with the fixed version in the Siemens advisory.
- If you cannot fix it yet
- Restrict write access to the folders Software Center searches for DLL files, such as its install and download directories.
- Brief staff not to paste commands from web pages into Windows, which is how ClickFix attacks work.
- Watch for
- Unexpected DLL files appearing in Siemens Software Center folders or being loaded by the application.
- New outbound connections from engineering or office PCs shortly after a user pasted a command from a web page.
- ATT&CK for ICS
- T0863User Execution
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: The Hacker News (opens thehackernews.com)
More on Siemens CVE-2026-110936