Siemens Software Center DLL flaw exploited in ClickFix malware attacks

Siemens disclosed the flaw on October 15 in an advisory that assigned it a CVSS v4 score of 8.4. The vulnerability exists because the program doesn't properly restrict the locations it searches for DLL files. Siemens then revealed that threat actors have exploited the issue in a malware campaign.

The scale reported so far comes from Huntress, which responded to at least 40 incidents in the campaign. Huntress also said it believes signed programs from other vendors are probably being misused as well, so the pattern is unlikely to stay limited to one product.

The attackers paired a legitimate copy of the Siemens program, which carried a valid digital signature, with malicious DLL files they supplied themselves. Because the program does not properly restrict where it looks for DLLs, an attacker supplied file can be found and loaded by a binary that is itself genuine and signed.

That combination is what makes this awkward to spot. Signature checks on the executable pass. The malicious code arrives in a file alongside it.

A short list of checks for teams running Siemens software or relying on signature trust in general.

1. 01

   Inventory installs of Siemens Software Center

   Query your asset or endpoint platform for the installed product name and version across engineering workstations and build hosts. In Windows environments, a quick pass is a WMI or registry query over the uninstall keys. Any install you cannot account for, especially outside managed engineering estates, is worth treating as suspect.

2. 02

   Apply the vendor advisory guidance

   Pull the Siemens advisory for CVE-2026-110936 and map the fixed version against what you have deployed. Track remediation per host rather than per site. A host that reports as patched but still runs an old binary from a user writable copy is not fixed.

3. 03

   Hunt for DLLs sitting next to signed binaries

   Search user writable paths such as Downloads, Temp and per user application data for executables that carry a valid signature but sit beside unsigned or recently created DLL files. Use sigcheck or a scripted Authenticode check. A signed vendor executable in a download folder with a fresh DLL next to it is a strong lead.

4. 04

   Alert on image loads of unsigned modules

   In your endpoint detection tooling, build a query over module load events where the loading process is signed and the loaded DLL is unsigned or signed by an unrelated party. Sysmon event id 7 covers this if you collect it. Steady volume from one host or one directory deserves a look.

5. 05

   Review how your users are led to run installers

   Check web proxy and email gateway logs for pages and messages that instruct users to copy a command or run a downloaded file. Clipboard driven lures depend on the user pasting into a run dialog or terminal. Look for parent process chains from browsers to command interpreters.

6. 06

   Stop treating a valid signature as sufficient

   Review allowlisting rules in AppLocker or Windows Defender Application Control that permit anything signed by a trusted publisher. Tighten them to specific paths and file hashes where you can. A rule that permits any signed binary from any location is the condition this technique relies on.