Schneider Electric Floating License Manager - CVE-2024-2658 Local Privilege Escalation via Uncontrolled Search Path in FlexNet Publisher
Schneider Electric Floating License Manager (TL-2026-1053), also tracked as ZDI-24-359, is a high-severity software vulnerability scored CVSS 7.8, first published 2026-06-26. It has no confirmed attribution, affects Flexera FlexNet Publisher, references 1 CVE (CVE-2024-2658), maps to 13 MITRE ATT&CK techniques (T1012, T1036, T1057), and is covered by 9 detection rules and 20 indicators of compromise.
Key facts for TL-2026-1053
- Threat ID
- TL-2026-1053
- Also known as
- ZDI-24-359
- Severity
- HIGH
- CVSS
- 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- 2026-06-26
- Last reviewed
- 2026-06-26
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- industrial, manufacturing, energy, critical infrastructure, commercial facilities, food and agriculture, government services and facilities, transportation systems, water and wastewater systems, cross-sector any flexnet publisher licensee
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in Schneider Electric Floating License Manager
Malware and tooling: Kaspersky Industrial CyberSecurity (KICS)
CVE-2024-2658 is a local privilege-escalation vulnerability (CWE-427, Uncontrolled Search Path Element) in Flexera's FlexNet Publisher, bundled by Schneider Electric's Floating License Manager (FLM). A low-privileged local user can create a hardcoded, normally non-existent directory and plant a malicious openssl.cnf that points the OpenSSL 'dynamic_path' engine directive at an attacker-controlled DLL, which the lmadmin.exe license daemon then loads, yielding elevated code execution in the service's security context.
How Schneider Electric Floating License Manager works
FlexNet Publisher's lmadmin.exe license-management daemon references an OpenSSL configuration file at a fixed, hardcoded filesystem path (under a Cygwin-derived directory tree such as C:\cygwin\home ightly\...\contrib\openssl\...\openssl\) that does not exist by default on a standard Windows installation. Because the path lacks access-control validation and the parent directories are frequently writable by the Authenticated Users group, any locally authenticated low-privileged user can create the missing directory structure and drop a crafted openssl.cnf there. That configuration file can set an OpenSSL engine 'dynamic_path' directive to point at an attacker-supplied DLL. When the lmadmin service (or a vendor daemon that has TLS/OpenSSL enabled) starts, restarts, or reloads its OpenSSL engine configuration, it loads and executes the attacker's DLL inside the lmadmin.exe process. Because lmadmin.exe (installed as the 'lmadminSchneider' or equivalent vendor-branded Windows service) commonly runs under a privileged local service account with SeImpersonatePrivilege or similar elevated token privileges, code execution inside that process context allows the attacker to escalate from an unprivileged local account to SYSTEM-equivalent access, typically chained with well-known 'Potato'-family token-impersonation techniques once arbitrary code execution is achieved inside the service. The vulnerability was identified and responsibly disclosed by researcher Xavier DANEST working with Trend Micro's Zero Day Initiative (ZDI-24-359), reported to the vendor on 2023-11-28, and publicly disclosed in a coordinated April 2024 Flexera/ZDI advisory. Kaspersky's Securelist team later (2026-06-26) published an independent technical breakdown covering the exploit chain and detection guidance, framing the risk to industrial environments given FlexNet Publisher's broad reuse as a bundled licensing component across many ICS/OT and enterprise-software vendors beyond Schneider Electric alone. The issue is fixed upstream in FlexNet Publisher 2024 R1 (11.19.6.0); Schneider Electric's own remediation is delivered via Floating License Manager 3.0.0.0 or later, which bundles the patched FlexNet Publisher component.
MITRE ATT&CK techniques used in TL-2026-1053
Discovery
T1012 Query Registry; T1057 Process Discovery; T1069 Permission Groups Discovery; T1083 File and Directory Discovery
Defense Evasion
T1036 Masquerading; T1574 Hijack Execution Flow
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1078 Valid Accounts; T1134 Access Token Manipulation
Execution
T1129 Shared Modules; T1569 System Services
defense-impairment
T1222 File and Directory Permissions Modification
Persistence
T1543 Create or Modify System Process
stealth
Affected products and versions in Schneider Electric Floating License Manager
- Flexera — FlexNet Publisher
Vulnerable versions: up to and including 11.19.6.0 (prior to 2024 R1)
Fixed in: 2024 R1 (11.19.6.0) and later - Schneider Electric — Floating License Manager (FLM)
Vulnerable versions: versions bundling FlexNet Publisher prior to 2024 R1
Fixed in: 3.0.0.0 and later - Schneider Electric — EcoStruxure Control Expert
Vulnerable versions: prior to 16.2
Fixed in: 16.2 and later - Schneider Electric — EcoStruxure Process Expert
Vulnerable versions: prior to 2023_v4.8.0.5715
Fixed in: 2023_v4.8.0.5715 and later - Schneider Electric — EcoStruxure OPC UA Server Expert
Vulnerable versions: versions bundling affected FlexNet Publisher / Revenera licensing component
Fixed in: vendor-patched release per Schneider Electric advisory - Schneider Electric — Machine Expert
Vulnerable versions: versions bundling affected FlexNet Publisher / Revenera licensing component
Fixed in: vendor-patched release per Schneider Electric advisory - Schneider Electric — Operator Terminal Expert
Vulnerable versions: versions bundling affected FlexNet Publisher / Revenera licensing component
Fixed in: vendor-patched release per Schneider Electric advisory - Schneider Electric — Vijeo Designer
Vulnerable versions: versions bundling affected FlexNet Publisher / Revenera licensing component
Fixed in: vendor-patched release per Schneider Electric advisory - Schneider Electric — Zelio Soft 2
Vulnerable versions: versions bundling affected FlexNet Publisher / Revenera licensing component
Fixed in: vendor-patched release per Schneider Electric advisory
Remediation for Schneider Electric Floating License Manager
Patches
- Upgrade FlexNet Publisher to version 2024 R1 (11.19.6.0) or later
- Upgrade Schneider Electric Floating License Manager to version 3.0.0.0 or later, which bundles the patched FlexNet Publisher component
Immediate actions
- Restrict write permissions to the C:\cygwin directory tree (and any parent directories in the hardcoded OpenSSL config search path) from the Authenticated Users / Everyone groups on hosts running FlexNet Publisher-based license managers
- Audit which local accounts have write access to the root of the C:\ drive and to FlexNet Publisher's installation and working directories
- Restrict interactive/local logon rights on servers hosting the Floating License Manager to trusted administrative accounts only
- Monitor for creation of unexpected directories matching the hardcoded FlexNet Publisher OpenSSL config path, and for unsigned/unexpected DLLs referenced by an openssl.cnf 'dynamic_path' directive
Workarounds
- Remove or uninstall Floating License Manager / FlexNet Publisher from workstations and servers that do not require floating license checkout
- Restrict filesystem write access on the hardcoded OpenSSL configuration search path used by lmadmin.exe as an interim compensating control prior to patching
Longer-term hardening
- Deploy EDR/behavioral monitoring capable of flagging anomalous DLL loads into lmadmin.exe or other FlexNet Publisher vendor daemons
- Reduce the attack surface of the license-server service account by removing unnecessary impersonation privileges (e.g. SeImpersonatePrivilege) where the vendor daemon does not require them
- Isolate license servers on a dedicated, access-controlled management network segment rather than general-purpose workstations
- Track FlexNet Publisher / vendor-bundled license-manager versions in asset inventory and patch management as a distinct component, since it ships embedded inside many third-party products
CVEs associated with Schneider Electric Floating License Manager
CVE-2024-2658
Weaknesses (CWE) in Schneider Electric Floating License Manager
CWE-427
Timeline of Schneider Electric Floating License Manager
- Researcher Xavier DANEST reports the FlexNet Publisher uncontrolled search path issue to Trend Micro's Zero Day Initiative, which coordinates disclosure to Flexera.
- Zero Day Initiative publishes advisory ZDI-24-359 detailing the FlexNet Publisher Uncontrolled Search Path Element local privilege escalation vulnerability.
- ZDI advisory for ZDI-24-359 updated with additional detail.
- CVE-2024-2658 entry published in the National Vulnerability Database with CVSS v4.0 scoring (8.5, High).
- CISA publishes ICSA-25-037-02 covering CVE-2024-2658 across multiple Schneider Electric EcoStruxure engineering products (Control Expert, Process Expert, OPC UA Server Expert, Machine Expert, Operator Terminal Expert, Vijeo Designer, Zelio Soft 2) that bundle the vulnerable Revenera/FlexNet Publisher licensing component.
- CISA republishes ICSA-25-037-02 as Update D with additional affected Schneider Electric EcoStruxure product versions and refreshed mitigation guidance for CVE-2024-2658.
- NVD record for CVE-2024-2658 last modified.
- TL-Intel-Harness ingests the Securelist article via RSS and opens threat TL-2026-1053 for CVE-2024-2658.
- Kaspersky Securelist analyst Valery Akulenko publishes a technical breakdown of the CVE-2024-2658 exploit chain, including the KICS Kaspersky Industrial CyberSecurity Exploit Prevention alert example, highlighting risk to industrial environments running Schneider Electric's Floating License Manager.
Sources cited for Schneider Electric Floating License Manager
- Securelist: Schneider Electric CVE-2024-2658 Vulnerability
- NVD - CVE-2024-2658
- ZDI-24-359: FlexNet Publisher Uncontrolled Search Path Element Local Privilege Escalation
- Flexera Community: CVE-2024-2658 FlexNet Publisher Potential Local Privilege Escalation Issue
- SentinelOne Vulnerability Database: CVE-2024-2658
- CISA ICS Advisory ICSA-25-037-02: Schneider Electric EcoStruxure (Update D)
- NVD CVE-2024-2658 CVSS v4.0 Assessment (Flexera Software LLC)
Threats related to Schneider Electric Floating License Manager
- LegacyHive Exploitation Chain Bypasses Windows Security Even With July 2026 Patches Installed
- CVE-2026-20262: Cisco Catalyst SD-WAN Manager (vManage) Arbitrary File Upload Flaw Exploited as Zero-Day for Root Privilege Escalation
- "LegacyHive" Windows User Profile Service Zero-Day Allows Non-Admin Registry Hive Hijacking
- SolarWinds Serv-U 2026.3 Patches 16 Vulnerabilities (CVE-2026-28302 to CVE-2026-28321) Including Root RCE, IDOR-Chained Privilege Escalation, and Broken Access Control
Detection coverage for TL-2026-1053
As of 2026-06-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1053 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.