CVE-2026-69109
Received Received - Intake

Path Traversal in Siemens License Server

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: Siemens AG

Description
A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.3). The affected application is vulnerable to a path traversal vulnerability due to lack of sanitization of user input. This could allow a remote attacker to access arbitrary files on the application.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-69109
EUVD
EUVD-2026-56126

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
siemens license_server to 5.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-35 The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Siemens License Server (SLS) versions before V5.3. It allows a remote attacker to access arbitrary files on the server due to insufficient sanitization of user input, enabling path traversal attacks.

Detection Guidance

Detecting this vulnerability requires checking for Siemens License Server (SLS) versions older than V5.3. Inspect the installed version of SLS on your system. Use network scanning tools to identify SLS instances on your network and verify their versions.

Impact Analysis

An attacker could exploit this to read sensitive files on the server, potentially exposing confidential data, system configurations, or other critical information. This may lead to further attacks or data breaches.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations may face legal penalties, reputational damage, and loss of compliance certifications.

Mitigation Strategies

Upgrade Siemens License Server (SLS) to version V5.3 or later immediately. If upgrading is not possible, restrict network access to the SLS instance and apply strict input validation measures to prevent path traversal attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-69109. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart