Hackers Abuse Siemens Software Center Flaw to Secretly Install Malware

Hackers Abuse Siemens Software Center Flaw to Secretly Install Malware on Computers

Attackers are exploiting a vulnerability in Siemens Software Center to install malware using deceptive commands.

NationPulse Desk

Oct 23, 2026 · 4:33 PM 2 min read

Key takeaways

Hackers are exploiting a vulnerability in Siemens Software Center tracked as CVE-2026-110936 with a score of 8.4 out of 10.

The flaw affects version 3.5.8.7, which loaded helper files without proper validation.

Siemens released version 4.0.9.8 to fix the issue and urges users to update immediately.

Forescout linked the attacks to a delivery platform called Romulus that distributes malware such as LegionLoader.

Jose Oregon of Huntress Labs discovered the flaw and reported it to Siemens.

A security vulnerability in Siemens Software Center is being used by hackers to install malware on personal computers through a technique known as ClickFix, which deceives individuals into executing dangerous commands themselves so security defenses are bypassed.

Siemens cataloged this security issue as CVE-2026-110936, assigning it a score of 8.4 out of 10, and noted that version 3.5.8.7 is vulnerable because it failed to properly verify helper files before loading them. Because of this weakness, malicious actors can place a counterfeit file beside the legitimate application, causing the software to load it automatically, though Siemens has launched version 4.0.9.8 to resolve the issue.

During these attacks, a fraudulent website prompts victims to enter a command into PowerShell or the Run dialog box, which then downloads an installer named AllMyBasic.msi. This installer starts a valid, signed version of Siemens Software Center while simultaneously loading a harmful file called archive.dll to grant hackers remote access to the computer.

Security researchers at Forescout connected these incidents to a distribution network named Romulus, which functions as a shared backend capable of deploying various malware variants via ClickFix methods, including a payload named LegionLoader that extracts information from Chrome browsers, while other efforts used counterfeit ChatGPT applications to attract victims.

Jose Oregon, a researcher at Huntress Labs, initially found and disclosed the vulnerability to Siemens, which subsequently issued its advisory on October 15, deployed the patch on October 17, and verified active exploits on October 19 while confirming that no internal Siemens systems, products, or update channels were compromised.

Siemens strongly advises all users to upgrade Software Center to version 4.0.9.8 immediately. The company issued a warning stating, "Never paste a command from a web page into Win+R, the Run box, or PowerShell." It also pointed out that a legitimate "I am not a robot" verification procedure never requires users to execute commands, and reminded customers to obtain Siemens software exclusively from official channels.

Questions and answers