CVE-2026-110936: Siemens Software Center Flaw and ClickFix Exploit

The Siemens Software Center has been the focus of recent security concerns due to a vulnerability known as CVE-2026-110936. This high-severity flaw allows attackers to execute malicious code by exploiting DLL sideloading. The vulnerability is being actively used in what are known as ClickFix attacks.

What Changed in Siemens Software Center?

The key issue here is the DLL sideloading vulnerability within the Siemens Software Center, tracked as CVE-2026-110936. This flaw allows an authenticated local attacker to introduce a specially crafted DLL into the application’s search path, leading to potential arbitrary code execution. Siemens has patched this vulnerability in version 4.0.9.8, but until this update is applied, systems remain at risk.

In detail, the vulnerability arises because the application loads dynamic-link libraries (DLLs) from an uncontrolled search path. Specifically, it was discovered that threat actors can place their crafted "archive.dll" next to a genuine copy of Siemens Software Center, leveraging the trust of a signed application to mask malicious activities. This approach is particularly concerning as it bypasses security checks that rely on the application’s signed status.

Furthermore, it has been noted that attackers make use of legitimate application behaviors to avoid detection. The core problem is the lack of verification when the application loads DLLs, which means that any code placed strategically can be executed with the same level of trust as the legitimate application, making it a powerful tool for attackers.

Why It Matters: Risks of Remote Access Trojans

The ClickFix platform has capitalized on this vulnerability by executing a complex chain of operations that ultimately deploys a remote access trojan (RAT). A legitimate application like Siemens Software Center provides an attractive target for attackers because it is trusted and signed, allowing malicious code to evade basic security checks.

In practice, attackers utilize "msiexec.exe" to execute "AllMyBasic.msi," which then runs "SiemensSoftwareCenter.exe," as identified in the source. This series of actions effectively introduces the RAT into the system, giving attackers extensive control and facilitating further malicious activities like data exfiltration or system manipulation.

Connection to ChatGPT Custom GPTs

The campaigns exploiting this vulnerability have even utilized maliciously altered ChatGPT Custom GPTs. Victims are directed to fake URLs under the guise of legitimate resources. Once accessed, these URLs distribute ClickFix lures that execute PowerShell code, ultimately deploying an MSI installer that abuses DLL sideloading to install the RAT.

These fake URLs act as a critical initial step in the attack chain, disguising harmful intent behind seemingly credible online interfaces. When victims unknowingly engage with these resources, they inadvertently trigger a series of events leading to malware installation.

Am I Affected?

If you are using Siemens Software Center version 3.5.8.7 or earlier, your systems are vulnerable to this exploit. The use of older versions is particularly risky because these versions load helper files from their own folder without proper verification, as highlighted by Siemens in their advisory. Companies relying on this software should prioritize checking and updating to at least version 4.0.9.8 to mitigate the risk.

Securing Your Systems Against the Siemens Software Center Vulnerability

Immediate actions should include updating Siemens Software Center to version 4.0.9.8 or later. This version includes critical patches that address the DLL sideloading exploit. Additionally, you should start the application to complete the update process once installed.

Beyond the software update, Siemens advises organizations to actively block IP addresses and domains associated with the known indicators of compromise:

• 96.62.218[.]59
• wizardexpensive[.]com
• 2.27.248[.]127

Furthermore, be vigilant for instances where "SiemensSoftwareCenter.exe" runs from the "AppData\Local\Programs" directory and is started by "msiexec.exe." Such activity should be treated as suspicious, warranting immediate investigation.

Practical Steps and Considerations

To address this vulnerability efficiently:

• Confirm the version of Siemens Software Center running in your environment and upgrade to 4.0.9.8 or later without delay. This helps close the vulnerability window used by attackers.
• Implement blocking measures for the noted IP addresses and domains using your firewall or proxy configurations. These configurations should be regularly reviewed to ensure their effectiveness.
• Scrutinize any unusual application executions, especially those initiated by "msiexec.exe" from the mentioned directories. Look for patterns that deviated from standard operating protocols.
• Ensure endpoint detection systems are configured to alert you to attempts at running "SiemensSoftwareCenter.exe" from unconventional paths.
• Implement additional application whitelisting approaches to restrain unauthorized DLLs from executing within trusted applications.

These actions can help mitigate the risks associated with this current exploitation tactic and strengthen your overall network security posture.

Honest Limitations: What This Doesn’t Solve

While updating and bolstering defenses against these specific indicators of compromise are crucial, these steps do not address other potential vulnerabilities that could be exploited using similar DLL sideloading techniques. A comprehensive approach to security should include regular audits and updates of all system applications.

My advice is to use this incident as a springboard to review all applications within your environment that might similarly load DLLs from non-secure paths. A proactive security audit can help identify hidden weak points that could be leveraged by attackers in different contexts.

Preventive action and regular security audits can make the difference between a close call and an actual compromise.

Worked Example: Stopping Malicious Payloads

Consider an organization using Siemens Software Center version 3.5.8.7. The IT team first identifies all machines running this version, then initiates the update to version 4.0.9.8. A firewall rule is also implemented to block traffic to the IP addresses and domains associated with the malware campaigns:

• Configuration of firewall rules to block IP 96.62.218[.]59 and domain wizardexpensive[.]com.
• Deployment of policy to alert when "SiemensSoftwareCenter.exe" runs from "AppData\Local\Programs."
• Monitoring network traffic for evidence of "msiexec.exe" launching unexpected processes.
• Education sessions for end-users to recognize and report suspicious URLs or phishing attempts linked to ChatGPT interfaces.

These measures significantly reduce the risk of successful attacks leveraging the known vulnerability.

FAQs

• What is DLL sideloading?
  DLL sideloading is a technique where malicious DLLs are placed in paths where legitimate applications load libraries, thus executing harmful code under the guise of a trusted application.
• Has Siemens addressed similar vulnerabilities in the past?
  While the source does not specify, companies often face repetitive challenges with DLL sideloading, emphasizing the need for continuous patching and application monitoring.
• Could this vulnerability affect other Siemens products?
  The specific advisories and information pertain directly to Siemens Software Center. However, vigilance towards similar applications following related patterns is advisable.
• Should small businesses be as concerned as large enterprises?
  Yes, any operation using the affected software is potentially at risk. Smaller setups may be more vulnerable due to potentially less robust security infrastructures.

I recommend continuing to monitor official Siemens updates and remain engaged with cybersecurity resources like our recent discussions on developer workflows to stay informed and improve response readiness across your systems.