Siemens patches a root escalation in its license server, the privilege path nobody inventories

CISA has republished Siemens ProductCERT advisory SSA-077553 as ICSA-26-225-07, covering two flaws in Siemens License Server (SLS): a local privilege escalation caused by an insecure sudoers policy, and a path traversal that lets a remote attacker read arbitrary files ^[1][2][3]. The first one matters more than its category suggests, because licensing middleware is installed to make software work and is almost never treated as a privilege boundary ^[2].

According to the advisory, the sudoers issue could allow an attacker to execute arbitrary commands and plant malicious files as root, leading to full system compromise ^[2]. Siemens classifies it under CWE-732, incorrect permission assignment for a critical resource ^[4]. The path traversal is attributed to a lack of input sanitisation and mapped to CWE-35 ^[3][5]. Two CVEs are listed, CVE-2026-69108 and CVE-2026-69109, against affected ranges below V5.1 and below V5.3 ^[6].

The remediation is where operators should slow down. The sudoers fix is delivered in V5.1 or later; the path traversal fix requires V5.3 or later ^[7][8]. A site that patched to V5.1 and closed the ticket is still carrying the file read bug, because anything at or above V5.1 and below V5.3 remains in the affected range for the second issue ^[9]. Siemens lists SLS as deployed worldwide and categorised under the Information Technology sector rather than a plant-floor sector ^[10][11], which is precisely why it tends to fall between the OT asset inventory and the IT patch cycle.

Note also what the escalation does not require. The rest of the same advisory batch is user-interaction work: Solid Edge SE2025 before V225.0.15 and SE2026 before V226.0.7 carry seven CVEs in PAR, PSM and DFT file parsing that can crash the application or execute code in the context of the current process ^[12][13][14], and Simcenter Femap before V2606.0001 carries two out-of-bounds reads in BMP parsing triggered when a user is tricked into opening a malicious file ^[15][16]. Those give an attacker the engineer's session. The SLS sudoers policy is what turns that session into root on the same host, and it needs no file, no lure and no network path.

CISA's accompanying guidance is the standard set: minimise network exposure, keep control system devices off the internet, put them behind firewalls, and use VPNs where remote access is required ^[17]. None of that constrains a local sudoers policy. The republished text lists a relevant CWE for each vulnerability but leaves the metrics sections empty ^[18], so teams triaging by CVSS alone will find nothing to sort on and should treat the escalation as a host-integrity issue instead.

What to watch: whether your license server inventory exists at all, since SLS is bundled behind other Siemens products rather than procured as a security-relevant asset ^[10]; whether patch runs land on V5.3 rather than stopping at V5.1 ^[7][8]; and whether Siemens publishes severity scoring to accompany the CWE mappings already in the advisory ^[18].