Two Siemens License Server Vulnerabilities: Remote File Access and Root Privileges

CISA Reports Two Vulnerabilities in Siemens License Server

A CISA advisory identifies two vulnerabilities in Siemens License Server (SLS), the component used to manage Siemens software licenses. The product is widely used in the information technology sector; Siemens is headquartered in Germany.

CISA advisory ICSA-26-225-07, associated with Siemens ProductCERT advisory SSA-077553, was initially published by Siemens on August 11, 2026, and republished by CISA on August 13, 2026.

The two flaws have different characteristics. One requires local access and existing elevated privileges but may allow commands to be executed as root. The other can be exploited over the network without authentication and allows arbitrary files stored by the application to be read.

Siemens has released updated versions and recommends upgrading SLS to the latest available release. The advisory does not specify the exact fixed release.

Vulnerable Versions and the Two CVE Identifiers

The vulnerable conditions listed in the CSAF record are as follows:

• Siemens License Server (SLS) < V5.1: affected by CVE-2026-69108;
• Siemens License Server (SLS) < V5.3: affected by CVE-2026-69109.

As a result, systems upgraded to version 5.1 or later could still be exposed to the second vulnerability if they have not been upgraded to version 5.3 or a later release.

The advisory assigns the product an overall CVSS v3 score of 7.5, corresponding to the remotely accessible vulnerability. However, the two flaws have different scores and exploitation requirements.

CVE-2026-69108: Sudoers Policy Allows Operations with Root Privileges

CVE-2026-69108 concerns an unsafe sudoers policy configuration. It is classified as CWE-732, which covers incorrect permission assignment for a critical resource.

Exploitation requires local access and existing elevated privileges. This is therefore not, by itself, necessarily a flaw that allows an unauthenticated remote user to gain access to the system. However, it could allow an actor already present in the environment to:

• execute arbitrary commands;
• write malicious files with root privileges;
• fully compromise the affected system.

The CVSS 3.1 score is 6.0, with the following vector:

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

The vector indicates local access, low attack complexity, and a requirement for high privileges, with no user interaction. The impact primarily concerns system confidentiality and integrity; availability is not considered directly affected in the score.

CVE-2026-69109: Unauthenticated Arbitrary File Read

CVE-2026-69109 is a path traversal vulnerability classified as CWE-35. The application does not properly sanitize user-controlled input, allowing attackers to manipulate the requested path and access files outside the intended location.

The access requirements are more critical: the attack can be conducted remotely, without authentication or user interaction. The reported impact is the ability to read arbitrary files stored by the application.

The vulnerability has a CVSS 3.1 score of 7.5, with the following vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Operationally, an installation exposed to the network could allow an attacker to retrieve sensitive information without having an account. The brief does not specify which files were actually targeted or exfiltrated, nor does it report any confirmed compromises.

Who Is Exposed and Which Checks to Perform

Affected environments are those running Siemens License Server versions below the thresholds listed above. Risk also depends on service reachability: an instance isolated within a control network has a different attack surface from a server accessible from corporate networks—or, worse, directly from the Internet.

Administrators should:

1. identify all SLS installations and verify their versions;
2. upgrade them to the latest release provided by Siemens;
3. restrict network access using firewalls and restrictive rules;
4. prevent direct Internet exposure of control systems;
5. segment industrial networks, remote devices, and corporate networks;
6. use up-to-date VPNs for remote access and secure the devices from which connections originate;
7. configure the environment according to Siemens Industrial Security guidelines and product manuals.

Before making changes to operating systems or industrial infrastructure, organizations should conduct an impact analysis and risk assessment. They should also review logs for unusual requests targeting file paths, unexpected service access, and unauthorized changes to files or configurations made with administrative privileges.

Any suspicious activity should be handled according to internal incident response procedures and reported to CISA.

Alert Status and Operational Priority

It is not known whether these vulnerabilities have been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog. Consequently, no KEV remediation deadline is currently associated with the fixes, and no link to ransomware campaigns has been reported.

The absence of this information does not reduce the priority for exposed systems: CVE-2026-69109 requires no authentication and may allow remote file reads. For CVE-2026-69108, protecting local privileges and controlling administrative accounts remain essential.

The primary measure is to update Siemens License Server while also reducing its network exposure. Applying only the patch while leaving the service reachable from unnecessary networks does not eliminate the risks associated with insecure configurations and improper access.