Siemens License Server Patched for Critical Privilege Escalation and Path Traversal Vulnerabilities

Siemens License Server (SLS) is affected by multiple vulnerabilities which could allow an attacker to elevate privileges and read arbitrary files on the system, the company has confirmed. The Siemens ProductCERT reported the issues to CISA, which published advisory ICSA-26-225-07 on August 13, 2026.

The first flaw, tracked as CVE-2026-69108, is a local privilege escalation vulnerability due to an insecure sudoers policy. An attacker with local access could exploit this to execute arbitrary commands and plant malicious files as root, potentially leading to full system compromise. The CVSS v3.1 base score is 6.0 (MEDIUM), with the vector string AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N.

The second flaw, tracked as CVE-2026-69109, is a path traversal vulnerability resulting from lack of sanitization of user input. A remote attacker could exploit this to access arbitrary files on the application. The CVSS v3.1 base score is 7.5 (HIGH), with the vector string AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Siemens states that the affected product versions are SLS < V5.1 for CVE-2026-69108 and SLS < V5.3 for CVE-2026-69109. The vendor has released updated versions and recommends that all users update to at least V5.1 (for the privilege escalation fix) and V5.3 (for the path traversal fix). A link to the vendor's advisory and firmware is provided at https://support.sw.siemens.com/product/1586485382/.

CISA recommends that users minimize network exposure for all control system devices and ensure they are not accessible from the internet. When remote access is required, use secure methods such as VPNs, and isolate control system networks from business networks. Organizations should perform impact analysis and risk assessment prior to deploying defensive measures.

No public confirmation of active exploitation in the wild has been reported as of the advisory publication, but both vulnerability classes -- local privilege escalation and path traversal -- are frequently weaponized in operational technology and IT environments.