MalwarePublished 11 Jun 2026

Siemens Says Desigo CC Files Flagged as Malware by Security Engines

Source SecurityWeek

Description

A PowerShell script included in patch files appears to be triggering false positives by multiple security engines. The post Siemens Says Desigo CC Files Flagged as Malware by Security Engines appeared first on SecurityWeek .

Impact

There is no actual malware or compromise involved. The impact is limited to false positive detections by antivirus and security solutions, which may cause confusion or unnecessary alarm among users and administrators applying Desigo CC patches. There is no indication of exploitation or security breach related to this issue.

Defensive guidance

Siemens is actively collaborating with cybersecurity vendors to correct the false positive detections. Customers should verify the digital signatures of the patch files to confirm authenticity. No immediate action is required beyond applying patches as intended.

Summary

Siemens Desigo CC patch files for versions 7 to 9 include a PowerShell script compiled as an executable within a patchHelper utility. This script performs file system operations, registry modifications, and runs with elevated privileges, which are heuristically flagged as suspicious or malicious by various antivirus engines, leading to false positive malware detections. Siemens verified the integrity and digital signatures of the files, confirming no malicious changes. The issue is a false positive rather than an actual malware infection. Siemens is working with cybersecurity vendors to address these detection inaccuracies.

References

securityweek.com/siemens-says-desigo-cc-files-flagged-as-malware-by-security-engines/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 11 Jun 2026, 11:48 UTC

References

Community reviews