Siemens Software Center CVE-2026-110936 DLL search-path flaw exploited in ClickFix malware (CISA KEV): what version fixes it and how do I defend against it?

Am I affected: Siemens Software Center before V4.0.9.8 loads helper DLLs from an uncontrolled search path. Code planted next to it runs with the app's privileges. Siemens advisory SSA-580366 (Oct 15, 2026) fixed it, and Siemens confirmed exploitation on October 19. Huntress found it being used in ClickFix campaigns: users are tricked into running a command, and attackers drop a genuine, validly signed older copy of the program together with their own files, so trusted signed software ends up loading malware. You are at risk even if you never installed Siemens software, because attackers bring their own copy. How to check: - If you use it: check the installed version in Programs and Features. Anything below 4.0.9.8 needs the update. - For everyone on Windows: hunt for Siemens Software Center executables outside their normal install directory, especially in user-writable places like Downloads, AppData or Temp, and for unsigned DLLs sitting next to them. EDR tools usually flag signed binaries loading unsigned DLLs from the same folder. Fix: update Siemens Software Center to V4.0.9.8 or later, following SSA-580366. Interim mitigation and hardening: use application control (WDAC/AppLocker or your EDR) to block Siemens Software Center versions below 4.0.9.8 and to block executables running from user-writable folders. Teach users that 'paste this into Run/PowerShell to fix an error' prompts are attacks, and consider restricting the Win+R/PowerShell path for standard users. After cleanup: if you find the binary in an unusual place, treat that machine as infected. Isolate it, check for persistence (Run keys, scheduled tasks, services), and rotate credentials and browser sessions used on it. Sources: https://www.helpnetsecurity.com/2026/10/20/exploitation-siemens-software-center-vulnerability-cve-2026-110936/ https://thehackernews.com/2026/10/clickfix-attackers-exploit-siemens.html https://www.securityweek.com/siemens-software-center-vulnerability-exploited-in-clickfix-malware-attacks/