CVE-2026-69109 describes a path traversal vulnerability in Siemens License Server (SLS) affecting all versions before 5.3. The vulnerability arises from improper input sanitization, enabling remote attackers to manipulate file paths and access arbitrary files on the server. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact. Siemens has published the vulnerability but has not yet released an official fix or detailed remediation instructions.

Successful exploitation allows an unauthenticated remote attacker to read arbitrary files on the Siemens License Server, potentially exposing sensitive information. There is no impact on integrity or availability reported. This could lead to information disclosure risks depending on the files accessed.

Patch status is not yet confirmed — check the Siemens vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the Siemens License Server and monitor for suspicious activity related to file access attempts. Avoid exposing the service to untrusted networks.