Threat actors used a genuine, signed copy of Siemens Software Center to distribute malicious DLL files, infecting Windows PCs via ClickFix lures.
The vulnerability or weakness
The vulnerability, CVE-2026-110936, allows an authenticated local attacker to plant malicious DLL files that are executed with the same privileges as the Software Center.
| CVE | CVSS | Severity | In CISA KEV | KEV due date |
|---|---|---|---|---|
| CVE-2026-110936 | 8.4 | HIGH | No | - |
CVE data: NVD (nvd.nist.gov) and the CISA Known Exploited Vulnerabilities catalog.
Earlier attacks and coverage
No earlier related attack in our archive yet.
Business impact
This incident poses a risk to organizations that rely on Siemens software for critical operations, potentially leading to data breaches or system compromise.
Industries affected
Industries affected include manufacturing, energy, and any sector using Siemens software for critical infrastructure.
Users affected
Customers using Siemens Software Center are at risk, especially those with older versions that did not validate helper files before loading them.
