CISA republishes Siemens advisory on two License Server flaws

CISA republished a Siemens ProductCERT advisory on Aug. 13 describing two vulnerabilities in Siemens License Server and listing update guidance for affected versions.

CISA republished a Siemens ProductCERT advisory on Aug. 13 covering Siemens License Server, or SLS, and two vulnerabilities affecting earlier versions of the software.

One issue could let a local attacker gain higher privileges on the system. The other could let a remote attacker read arbitrary files on the application. CISA said the posting is a verbatim republication of the Siemens CSAF advisory and was provided as-is.

For CVE-2026-69108, CISA said SLS versions earlier than V5.1 are affected by a local privilege escalation issue tied to an insecure sudoers policy. The advisory says an attacker could execute arbitrary commands and place malicious files as root, which could lead to full system compromise. Siemens recommends updating to V5.1 or later. CISA lists the issue with a CVSS v3.1 base score of 6.0, rated medium.

For CVE-2026-69109, CISA said SLS versions earlier than V5.3 are affected by a path traversal flaw caused by a lack of input sanitization. The advisory says a remote attacker could access arbitrary files on the application. Siemens recommends updating to V5.3 or later. CISA lists the issue with a CVSS v3.1 base score of 7.5, rated high.

The advisory lists the critical infrastructure sector as information technology, says the product is deployed worldwide and identifies Siemens' headquarters location as Germany. Siemens ProductCERT reported the vulnerabilities to CISA, according to the posting.

CISA also recommended that organizations reduce network exposure, isolate control system networks behind firewalls, use VPNs for remote access when needed and keep those VPNs updated. It said organizations should perform impact analysis and risk assessment before applying defensive measures.

The advisory content first appeared with an initial release date of Aug. 11, according to the CISA page. The Aug. 13 revision history shows CISA's republication of Siemens ProductCERT advisory SSA-077553.

Sources

• CISA ICS advisory ICSA-26-225-07

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.