Siemens License Server (SLS) versions before 5.1 contain a local privilege escalation vulnerability caused by an insecure sudoers configuration. This misconfiguration allows an attacker with local access and elevated privileges to run arbitrary commands as the root user, enabling them to plant malicious files and fully compromise the system. The vulnerability is identified as CVE-2026-69108 and is associated with CWE-732 (Incorrect Permission Assignment for Critical Resource). The CVSS 3.1 base score is 6.0, reflecting local attack vector, low complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality and integrity but no impact on availability. No known exploits in the wild or vendor patch information are currently available.

An attacker with local access and high privileges can exploit the insecure sudoers policy to execute arbitrary commands as root. This can lead to full system compromise, including unauthorized access to sensitive data and the ability to modify or plant malicious files with root privileges. The vulnerability impacts confidentiality and integrity of the affected system but does not affect availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to trusted users only and monitor for any suspicious activity related to privilege escalation attempts. Avoid running Siemens License Server on systems where untrusted users have local access.