CISA ICS Advisory: Siemens License Server (SLS)

CISA has published an ICS advisory on August 13, 2026, warning that Siemens License Server contains multiple vulnerabilities that could allow an attacker to elevate privileges and read arbitrary files.

Multiple privilege escalation and arbitrary file read flaws

The advisory states that Siemens License Server is affected by several vulnerabilities. Successful exploitation could allow an attacker to elevate privileges on the system and read arbitrary files. The advisory does not say whether the flaws have been exploited in the wild.

Affected products

The vulnerabilities affect Siemens License Server (SLS). The advisory does not list specific version numbers that are vulnerable. Siemens has released a new version that addresses the issues.

What to do

• Update all installations of Siemens License Server to the latest version released by Siemens.
• Determine whether Siemens License Server (SLS) is deployed in any operational technology or industrial environments under your control.
• Follow Siemens’ guidance for the update and any additional mitigations published in their security advisory.
• Monitor Siemens’ official product security channel for further updates on this advisory.
• Apply the update with priority in environments where the License Server is exposed to untrusted networks or users.

Organizations operating industrial control systems or medical devices that rely on Siemens licensing infrastructure should treat this update as time-sensitive. The advisory highlights the importance of timely patching for components that, while not always directly visible, hold elevated privileges on critical systems.