CISA published an advisory on two vulnerabilities affecting Siemens License Server (SLS) versions below V5.1 and V5.3. CVE-2026-69108 stems from an insecure sudoers policy that permits a local attacker to execute arbitrary commands and plant files as root, resulting in full system compromise. CVE-2026-69109 involves a path traversal weakness enabling an attacker to read arbitrary files on the system.
From an identity and access standpoint, the sudoers misconfiguration is a classic privilege escalation vector: an attacker with a low-privilege foothold can elevate to root, gaining control over accounts, credentials, and any secrets stored on the host. On systems tied into broader authentication or directory infrastructure, root-level compromise can be a stepping stone to wider lateral movement.
What to take away: patch SLS to the latest version, and audit sudoers policies broadly \u2014 overly permissive sudo rules remain one of the most common and easily overlooked paths to full host takeover.