Siemens Patches Critical Software Center Vulnerability
The company released an update for a security flaw that allowed attackers to execute malicious code with service privileges.
Updated on Oct. 20, 2026 in Cybersecurity
Live Poll
Do you trust that major software companies sufficiently protect your devices from malware in their updates?
Siemens has issued an update for its Software Center application to address a critical DLL sideloading vulnerability. The flaw allowed attackers to deploy a remote access trojan by placing malicious files in uncontrolled search paths.
Why it matters
The vulnerability poses a significant security risk because it permits arbitrary code execution with elevated service privileges. Attackers have already utilized this flaw to deliver the Legion Loader malware via fake URLs promoted through malicious ChatGPT custom tools.
Siemens released version 4.0.9.8 of the Software Center to replace the vulnerable 3.5.8.7 build. The security flaw is officially tracked as CVE-2026-110936.
The players
Siemens
Siemens is a global technology conglomerate that provides industrial and infrastructure software solutions.
Jose Oregon
Jose Oregon is the security researcher who discovered the software vulnerability.
The details
The exploit chain involves attackers placing a malicious file named archive.dll within the AppData\Local\Programs directory to trigger code execution. The vulnerable application fails to verify helper files before loading them, allowing the Romulus platform to launch an MSI installer via msiexec.exe.
Timeline
Siemens released the software patch in October 2026.
The Tech Race
This vulnerability highlights the ongoing struggle to secure software supply chains against DLL sideloading exploits. As attackers increasingly rely on deceptive delivery platforms like malicious ChatGPT custom tools, enterprises must move faster to patch legacy loading mechanisms.
Users running Siemens Software Center version 3.5.8.7 should immediately update their systems to version 4.0.9.8 to mitigate the risk of remote code execution. Administrators should also remain cautious of unsolicited URLs or links originating from AI-generated content.
The takeaway
Users should prioritize updating their enterprise software to the latest versions to eliminate known attack vectors. Maintaining strict control over software directory permissions can help prevent DLL sideloading attempts by malicious actors.
Further reading
For more information on current software threats and remediation strategies, visit our Cybersecurity section.
Live Poll
Do you trust that major software companies sufficiently protect your devices from malware in their updates?
