ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan

Siemens has fixed a DLL sideloading flaw in Siemens Software Center that has already been abused in active ClickFix attacks. Tracked as CVE-2026-110936 with a CVSS v4 score of 8.4, the bug lets a local authenticated attacker drop a malicious DLL into a folder the app loads from, letting arbitrary code run with the privileges of the application; version 3.5.8.7 was affected and researcher Jose Oregon of Huntress Labs reported the issue. Attackers paired a legitimate, signed copy of the software with a rogue archive.dll, delivering it through the Romulus ClickFix platform—sometimes via fake ChatGPT Custom GPT pages—so that msiexec.exe runs an MSI package that launches SiemensSoftwareCenter.exe and ultimately installs a remote access trojan. Siemens urges customers to upgrade to version 4.0.9.8 or later, restart the application, block the shared malicious IPs and domains, and watch for SiemensSoftwareCenter.exe executing from AppData\Local\Programs via msiexec.exe.