Siemens Patches High‑Severity DLL Sideloader Used in ClickFix Campaigns

Siemens disclosed a critical flaw in its Software Center that attackers have leveraged in recent ClickFix operations, prompting the company to issue an emergency update. The vulnerability, catalogued as CVE-2026-110936 and rated 8.4 on the CVSS v4 scale, enables malicious code to be injected through a technique known as DLL sideloading.

DLL sideloading exploits the way Windows applications locate dynamic‑link libraries. By placing a specially crafted DLL in a location that the Software Center will automatically load, an adversary can execute arbitrary code with the same privileges as the legitimate application. In this case, the flaw could allow a remote attacker to gain full control of systems running the Siemens tool, opening the door to data theft, sabotage, or the deployment of additional malware.

Security researchers have linked the defect to the ClickFix threat group, which has a track record of targeting industrial and enterprise environments. The group has used the sideloading bug to drop a remote‑access trojan, granting operators persistent entry points into compromised networks. Victims are typically organizations that rely on Siemens automation software for manufacturing, energy, or infrastructure management, making the potential impact especially concerning for critical‑infrastructure sectors.

Siemens responded by releasing patches that replace the vulnerable components and by publishing guidance on how to mitigate the issue in the short term. The company advises administrators to apply the updates immediately, verify that all Software Center installations are running the latest version, and monitor systems for any unsigned DLLs that may have been introduced. Additional hardening measures, such as restricting write permissions to the application directory and employing application whitelisting, are also recommended.

The incident underscores the growing relevance of supply‑chain and software‑component vulnerabilities in the era of interconnected industrial systems. As attackers continue to hunt for weak points in widely deployed tools, organizations are urged to maintain robust patch‑management processes and to stay informed about emerging threats. Analysts expect further scrutiny of Siemens’ product line and may see regulatory bodies push for stricter security standards in the automation sector.