TL;DR

what: Siemens patched CVE-2026-110936, a DLL sideloading flaw in Siemens Software Center, after confirming that ClickFix operators abused a signed copy of the application to load a malicious archive.dll.

impact: A victim who pastes a ClickFix lure command ends up running PowerShell that drops an MSI, which launches the trusted Siemens binary and executes attacker code that installs a remote access trojan.

fix: Siemens fixed the flaw in Siemens Software Center 4.0.9.8, says the application must be started to apply the update, and recommends blocking the published IP addresses and domain.

who: Any Windows user reachable by ClickFix lures is at risk whether or not Siemens software is installed, and organizations running Siemens Software Center 3.5.8.7 or earlier also carry the local privilege-context exposure.

A signed, trusted Siemens binary is being used as the launch vehicle for a remote access trojan.…