LOWMalware
Global

ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan

·Source: The Hacker News

Updated:

Executive Summary

Siemens has addressed a DLL sideloading vulnerability impacting Siemens Software Center that it said has been exploited in ClickFix attacks. The high-severity vulnerability, tracked as CVE-2026-110936 (CVSS v4 score: 8.4), could allow an attacker to place a specially-crafted DLL in a directory the application searches, resulting in execution of malicious code with the same privileges as the

Analysis

Siemens has addressed a DLL sideloading vulnerability impacting Siemens Software Center that it said has been exploited in ClickFix attacks. The high-severity vulnerability, tracked as CVE-2026-110936 (CVSS v4 score: 8.4), could allow an attacker to place a specially-crafted DLL in a directory the application searches, resulting in execution of malicious code with the same privileges as the

Indicators of Compromise (1)

CVE (1)
CVE-2026-110936
NVDMITRE CVE
Source Attribution

Originally published by The Hacker News on Oct 20, 2026.

Related Threats

CRITICALVulnerability

Siemens Software Center

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-03.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to

CVE-2026-110936
CISA Advisories
HIGHVulnerability

CISA KEV: Siemens Software Center — Siemens Software Center Uncontrolled Search Path Element Vulnerability

Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.

CVE-2026-110936Siemens Software Center
CISA KEV
MEDIUMMalware

Australia severs criminal access to 180,000 computers after breaching Amadey malware backend

Lukas Brandt writes: Criminals using the Amadey malware lost control of about 180,000 infected computers after operators from the Australian Signals Directorate (ASD) gained access to the operation&#8217;s backend and severed the connection between the controllers and the victims. &#8220;The next steps that we took were to disconnect that Amadey controller from all those victims,&#8221;...

DataBreaches.net