Siemens License Server (SLS): 2 CVEs, High 7.5
Summary
CISA reports 2 vulnerabilities in Siemens Siemens License Server (SLS). Weakness types: Incorrect Permission Assignment for Critical Resource, Path Traversal: '.../...//'. Siemens License Server is affected by multiple vulnerabilities which could allow an attacker to elevate its privileges and read arbitrary files on the system. Siemens has released a new version for Siemens License Server (SLS) and recommends to update to the latest version. Highest CVSS v3 score: 7.5 (High), exploitable over the network.
At a glance
- Vendor
- Siemens
- Products
- Siemens License Server (SLS)
- CVEs
- CVE-2026-69108, CVE-2026-69109
- Highest CVSS v3
- 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Information Technology
- Deployed
- Worldwide
- Vendor HQ
- Germany
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-69108 | Incorrect Permission Assignment for Critical Resource | 6.0 | – | No | CVE-2026-69108 |
| CVE-2026-69109 | Path Traversal: '.../...//' | 7.5 | – | No | CVE-2026-69109 |
Affected products (2)
- Siemens License Server (SLS) < V5.1
- Siemens License Server (SLS) < V5.3
Vendor fixes and mitigations (from advisory)
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
- CISA advisory ICSA-26-225-07
- Machine-readable CSAF record
- https://cert-portal.siemens.com/productcert/csaf/ssa-077553.json
- https://cert-portal.siemens.com/productcert/html/ssa-077553.html
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.