VulnSocial

CVE-2026-11414Disclosure(altium / on-prem_enterprise_server)

LOWCVSS 9.8 · CRITICAL

Signal is active with 4 mentions in latest observed window

Immediate actions

  • Patch altium on-prem_enterprise_server systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A hard-coded cryptographic key is used by Altium Enterprise Server to sign file download URLs in the Vault service. Because the key is identical across all installations, an unauthenticated network attacker who can reach the server can forge valid download signatures and retrieve files from the Vault storage area without any authentication, session, or credentials. A separate path traversal vulnerability in the same download endpoint allows the configured storage root to be escaped, enabling reads of arbitrary files on the server filesystem. Combined, these issues allow an unauthenticated attacker to obtain sensitive server configuration and key material, which can lead to full server compromise. The vulnerability can be chained with CVE-2026-9152 to enumerate and bulk-download stored content. Altium 365 cloud deployments are not impacted in practice, as file storage uses object storage rather than the local filesystem.

altium CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-22CWE-798

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • on-prem_enterprise_server

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 4 signals
  • Disclosure: 4 classified signals
  • 4 total mentions across 1 day

Affected systems

Vendors
altium
Products
on-prem_enterprise_server

Deep dive

Activity timeline4 mentions / 1d
01234Mentions · 2026-06-06: 4Patch / Workaround · 2026-06-06: 1Technical Details · 2026-06-06: 406-06
Signal classification1 categories
Disclosure
4100.0%
Referenced assets4 URLs
Full discourse4 posts
  • Upwind Security MDR@UpwindMDR
    Disclosure

    🚨 Critical - Multiple Vulnerabilities Disclosed in Altium Enterprise Server (CVE-2026-11429, CVE-2026-11423, CVE-2026-11419, CVE-2026-11420, CVE-2026-11414) A cascade of severe flaws has been disclosed affecting Altium Enterprise Server, including unauthenticated path traversal and hard-coded cryptographic keys. Attackers can exploit these vulnerabilities to read/write arbitrary files, bypass authentication, and achieve full Remote Code Execution (RCE). 👉 Pre-auth RCE & data exposure risks | Altium 365 cloud deployments are largely mitigated or remediated, but self-managed Altium Enterprise Server instances must patch immediately.

    Post summary

    Multiple severe vulnerabilities (CVE-2026-11429, CVE-2026-11423, CVE-2026-11419, CVE-2026-11420, CVE-2026-11414) in Altium Enterprise Server have been disclosed, enabling RCE and data exposure; immediate patching is required for self‑managed instances.

    00010108
    207 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-11414 A hard-coded cryptographic key is used by Altium Enterprise Server to sign file download URLs in the Vault service. Because the key is identical across all installati… https://www.cve.org/CVERecord?id=CVE-2026-11414

    Post summary

    The advisory reveals that Altium Enterprise Server uses a hard‑coded, identical cryptographic key to sign file download URLs in its Vault service, potentially allowing URL forgery.

    00000176
    57.6K followersView on X
  • SecAlerts@SecAlertsCo
    Disclosure

    CVE-2026-11414: Critical 10.0 in Altium Enterprise Server. A hard-coded crypto key shared across ALL installs lets unauthenticated attackers sign file download URLs and exfiltrate files via path traversal. No auth needed. Check your Vault service now. https://secalerts.co/vulnerability/CVE-2026-11414 https://t.co/oDzpqSmN0k

    Post summary

    The message discloses CVE‑2026‑11414, a critical flaw in Altium Enterprise Server caused by a hard‑coded crypto key that lets unauthenticated users sign URLs and exfiltrate files via path traversal, and urges users to verify their Vault service.

    0000072
    831 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-11414 Unauthenticated Arbitrary File Access in Altium Enterprise Server... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-11414 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4

    Post summary

    The tweet simply announces CVE‑2026‑11414, linking to a vulnerability database entry and offering alerts, without providing PoC, exploit, patch, or detailed technical data beyond the basic vulnerability type.

    0000049
    4.0K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appaltiumon-prem_enterprise_server---

Explore more

Back to dashboardaltium CVEson-prem_enterprise_server vulnerabilities