Siemens Fixes Software Center DLL Sideloading Flaw Exploited in ClickFix Attacks

What was reported

Siemens has released a fix for a DLL sideloading vulnerability in Siemens Software Center. The company said the flaw has been exploited in ClickFix attacks. The issue is tracked as CVE-2026-110936 and carries a CVSS v4 score of 8.4, which places it in the high-severity range.

How the weakness works

DLL sideloading occurs when an application loads a library from a location an attacker can influence. In this case, an attacker could place a specially crafted DLL in a directory the application searches. The application would then execute the attacker's code with the same privileges the application itself holds.

The source ties the exploitation to ClickFix attacks, which generally depend on persuading a user to take an action themselves. The source excerpt does not give further detail on the campaigns, the affected versions or the fixed version, so those should be confirmed from the Siemens advisory.

Why it matters for regulated institutions

Engineering and industrial teams often install vendor tooling on workstations with elevated rights. A flaw that runs code at the application's privilege level can therefore matter more than its label suggests. Institutions should confirm whether Siemens Software Center is present in their estate and treat the update as a priority.