Siemens patches Software Center flaw exploited to deliver malware

Siemens has patched a Software Center vulnerability that it says attackers exploited in ClickFix campaigns to execute malicious code. The flaw, CVE-2026-110936, lets a specially crafted library run with the affected application's privileges when loaded from an uncontrolled search path. Attackers placed a malicious archive.dll beside a legitimately signed copy of Siemens Software Center. Huntress linked some campaigns to malicious ChatGPT Custom GPTs that directed victims to fake pages, where instructions tricked them into running PowerShell code that ultimately installed a remote access trojan. The fix is available in version 4.0.9.8. Siemens advises organizations to update to that version or later and start the application to apply the update.