CVE-2026-69108 & CVE-2026-69109: Siemens License Server Privilege Escalation and Arbitrary File Read — Detection and Remediation Guide

---
title: Path Traversal Sequence Targeting Siemens License Server
id: 3f9c1a72-8b4d-4e5a-a6c1-2d7e9f0b1c34
status: experimental
description: Detects classic and filter-evasion path traversal sequences (including the '.../...//' variant referenced in CVE-2026-69109) in process command lines or web request logs associated with license server activity.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-07
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/08/12
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_traversal:
    CommandLine|contains:
      - '.../...//'
      - '..\\..\\'
      - '../../'
      - '%2e%2e'
      - '..%2f'
      - '%252e%252e'
  selection_context:
    CommandLine|contains:
      - 'SLS'
      - 'LicenseServer'
      - 'Siemens License'
      - 'licensing'
  condition: selection_traversal and selection_context
falsepositives:
  - Rare; legitimate administrative scripts referencing relative paths near license tooling
level: high
---
title: Siemens License Server Process Reading Files Outside Install Directory
id: 7c2e5b91-4d6f-4a3b-9c8e-1f0a2b3d4e56
status: experimental
description: Detects the Siemens License Server service process accessing sensitive files outside its installation and license data directories, consistent with exploitation of the arbitrary file read vulnerability (CVE-2026-69109).
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-07
  - https://attack.mitre.org/techniques/T1005/
author: Security Arsenal
date: 2026/08/12
tags:
  - attack.collection
  - attack.t1005
logsource:
  category: file_event
  product: windows
detection:
  selection_process:
    Image|contains:
      - 'Siemens\\SLS'
      - 'Siemens License Server'
      - 'Licsrv'
  selection_target:
    TargetFilename|contains:
      - '\\Windows\\System32\\config\\'
      - '\\Windows\\NTDS'
      - '\\Users\\'
      - '.ssh'
      - 'web.config'
      - '.pem'
      - '.key'
      - 'unattend.xml'
  condition: selection_process and selection_target
falsepositives:
  - Backup or inventory software impersonating service context; validate process lineage
level: high
---
title: Writable Binary or DLL Replacement in Siemens License Server Path
id: 9a4d6e13-2b7c-4f5a-8d9e-0c1b2a3d4f67
status: experimental
description: Detects creation or modification of executables and DLLs inside the Siemens License Server installation directory by accounts other than SYSTEM or Administrators, consistent with CVE-2026-69108 permission misassignment abuse for privilege escalation.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-07
  - https://attack.mitre.org/techniques/T1574/
author: Security Arsenal
date: 2026/08/12
tags:
  - attack.privilege_escalation
  - attack.persistence
  - attack.t1574
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\\Siemens\\SLS\\'
      - '\\Siemens License Server\\'
      - '\\Program Files (x86)\\Siemens\\'
  selection_ext:
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
      - '.bat'
      - '.ps1'
  filter_user:
    User|contains:
      - 'SYSTEM'
      - 'Administrator'
      - 'S-1-5-18'
  condition: selection_path and selection_ext and not filter_user
falsepositives:
  - Software deployment tools (SCCM/Intune) writing under a service account; baseline expected updater identities
level: high

// Hunt 1: Path traversal attempts in requests/logs mentioning Siemens License Server
let TraversalPatterns = dynamic([".../...//", "../..", "..\\..", "%2e%2e", "..%2f", "%252e%252e"]);
union isfuzzy=true (CommonSecurityLog | project TimeGenerated, DeviceName, SourceIP, DestinationIP, Message),
(Syslog | project TimeGenerated, Computer, HostIP, Message)
| where TimeGenerated > ago(7d)
| where Message has_any (TraversalPatterns)
| where Message has_any ("SLS", "LicenseServer", "Siemens", "licens")
| project TimeGenerated, DeviceName, Computer, SourceIP, DestinationIP, Message
| order by TimeGenerated desc;

// Hunt 2: SLS-related processes accessing sensitive paths (arbitrary file read behavior)
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFolderPath has_any ("Siemens", "SLS", "License Server")
   or InitiatingProcessFileName has_any ("licsrv", "sls", "lmgrd")
| where FileName has_any ("SAM", "SECURITY", "NTDS.dit", "unattend.xml", "web.config")
   or FolderPath has_any ("\\config\\SAM", "\\.ssh\\", "\\NTDS\\")
   or FileName endswith ".pem" or FileName endswith ".key"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, FileName, AccountName
| order by TimeGenerated desc;

// Hunt 3: Binary/DLL writes into Siemens install paths by non-system accounts (CVE-2026-69108 precondition)
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where ActionType in ("FileCreated", "FileModified")
| where FolderPath has_any ("\\Siemens\\SLS\\", "Siemens License Server")
| where FileName endswith ".exe" or FileName endswith ".dll"
| where AccountName !in~ ("system", "administrator") and AccountName !startswith "s-1-5-18"
| project TimeGenerated, DeviceName, FileName, FolderPath, AccountName, InitiatingProcessFileName, SHA256
| order by TimeGenerated desc;

-- Siemens License Server: version discovery, process state, and weak-ACL binary audit
-- Deploy as a hunt across engineering/OT-adjacent Windows hosts

LET installs = SELECT FullPath, parse_pe(file=FullPath).FileVersion AS FileVersion
FROM glob(globs=[
  'C:/Program Files/Siemens/**/*.exe',
  'C:/Program Files (x86)/Siemens/**/*.exe',
  'C:/Siemens/**/*.exe'
])
WHERE FullPath =~ '(?i)(sls|licsrv|licens)'

SELECT * FROM installs

-- Running SLS processes and their service accounts
SELECT Pid, Name, Exe, CommandLine, Username
FROM pslist()
WHERE Exe =~ '(?i)siemens'
   OR Name =~ '(?i)(sls|licsrv|licens)'

-- Flag world-writable or user-writable executables in SLS install paths
SELECT FullPath, stat(file=FullPath).Mode.String AS Mode
FROM glob(globs=[
  'C:/Program Files/Siemens/**/*.exe',
  'C:/Program Files/Siemens/**/*.dll',
  'C:/Program Files (x86)/Siemens/**/*.exe'
])
WHERE Mode =~ 'w'

# Siemens License Server (SLS) exposure audit - CVE-2026-69108 / CVE-2026-69109
# Run elevated on each candidate license server host. READ-ONLY audit.

$report = @()

# 1) Locate SLS installations
$paths = @(
  "$env:ProgramFiles\Siemens",
  "${env:ProgramFiles(x86)}\Siemens",
  "C:\Siemens"
) | Where-Object { Test-Path $_ }

foreach ($p in $paths) {
  Get-ChildItem -Path $p -Recurse -Include *.exe -ErrorAction SilentlyContinue |
    Where-Object { $_.Name -match '(?i)(sls|licsrv|licens)' } |
    ForEach-Object {
      $report += [pscustomobject]@{
        Type    = 'Binary'
        Path    = $_.FullName
        Version = $_.VersionInfo.FileVersion
        Issue   = if ([version]($_.VersionInfo.FileVersion) -lt [version]'5.1') { 'VULNERABLE - below 5.1' } else { 'Verify against vendor fixed branch (5.1 / 5.3)' }
      }
    }
}

# 2) Check running SLS services and their logon accounts
Get-CimInstance Win32_Service |
  Where-Object { $_.PathName -match '(?i)siemens' -and $_.PathName -match '(?i)(sls|licens)' } |
  ForEach-Object {
    $report += [pscustomobject]@{
      Type    = 'Service'
      Path    = $_.PathName
      Version = ''
      Issue   = "Running as: $($_.StartName) — flag if LocalSystem/NetworkService (excessive privilege)"
    }
  }

# 3) ACL audit: find executables/DLLs writable by non-admin principals (CVE-2026-69108 pattern)
foreach ($p in $paths) {
  Get-ChildItem -Path $p -Recurse -Include *.exe,*.dll -ErrorAction SilentlyContinue | ForEach-Object {
    try {
      $acl = Get-Acl $_.FullName
      $weak = $acl.Access | Where-Object {
        $_.FileSystemRights -match 'Write|Modify|FullControl' -and
        $_.IdentityReference -match 'Users|Everyone|Authenticated Users' -and
        $_.AccessControlType -eq 'Allow'
      }
      if ($weak) {
        $report += [pscustomobject]@{
          Type    = 'WeakACL'
          Path    = $_.FullName
          Version = ''
          Issue   = ('Writable by: ' + (($weak.IdentityReference | Select-Object -Unique) -join ', '))
        }
      }
    } catch {}
  }
}

$report | Format-Table -AutoSize -Wrap
$report | Export-Csv -Path "$env:TEMP\SLS_Audit_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation
Write-Host "`nAudit complete. Remediate by upgrading SLS per Siemens advisory (ICSA-26-225-07) and tightening flagged ACLs."