Siemens License Server Demands Two Separate Security Updates
The split-version fix means remediation teams can't push one update and call it done.
TL;DR
CISA republished a Siemens advisory for two Siemens License Server vulnerabilities. CVE-2026-69108 (CVSS 6.0, local privilege escalation via insecure sudoers policy) is fixed in version 5.1. CVE-2026-69109 (CVSS 7.5, remote path traversal requiring no authentication) is fixed in version 5.3. The split-version remediation means organizations running heterogeneous SLS deployments face two separate upgrade targets, and Siemens hasn't indicated whether either update breaks backward compatibility with existing license-dependent systems.
CISA published ICSA-26-225-07 on August 13, republishing Siemens ProductCERT advisory SSA-077553 for Siemens License Server. The advisory covers two vulnerabilities, and the fix isn't one update, it's two separate version targets.
CVE-2026-69108 is a local privilege escalation stemming from an insecure sudoers policy. An attacker with high privileges on the local system can execute arbitrary commands and plant files as root, leading to full system compromise. The CVSS v3.1 score sits at 6.0 (Medium), and the fix is version 5.1.
CVE-2026-69109 is a remote path traversal, no authentication required. Unsanitized user input lets a remote attacker read arbitrary files on the application. The CVSS v3.1 score is 7.5 (High), and the fix is version 5.3.
The operational wrinkle is the version split. An organization running SLS 5.0 gets the privilege fix at 5.1 but still needs 5.3 to close the path traversal. Siemens hasn't indicated whether either update is backward-compatible with existing license verification workflows, which means compliance teams at defense contractors and ISVs should test before deploying. A license server outage that breaks production systems is a self-inflicted wound no CVE advisory requires.
Published ·Deep Fathom