CVE-2026-11419Disclosure(altium / on-prem_enterprise_server)

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch altium on-prem_enterprise_server systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A path traversal vulnerability exists in the Altium Enterprise Server Vault Service UploadController due to improper validation of a user-controlled path component in image upload requests. An authenticated user can supply a crafted absolute path so that the configured storage root is discarded, allowing arbitrary files to be written to any location on the server filesystem writable by the service account. Because content-controlled files can be written to web-accessible directories, or used to overwrite application binaries or configuration files, this can be escalated to remote code execution, service takeover, or denial of service. Altium 365 cloud deployments are not affected, as the affected endpoint is not reachable and the cloud storage architecture mitigates the file-write primitive.

altium CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://www.altium.com/platform/security-compliance/security-advisories

Weakness type (CWE)

CWE-22CWE-434

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

on-prem_enterprise_server

Threat summary

Patch or workaround signal is available
4 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 4 signals
Disclosure: 3 classified signals
Peaked 1d ago at 3 mentions (2026-06-06); latest day: 1
4 total mentions across 2 days

Affected systems

Vendors

altium

Products

on-prem_enterprise_server

Deep dive

Activity timeline4 mentions / 2d

Signal classification2 categories

Disclosure

375.0%

Patch

125.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-06	3	Disclosure3
2026-07-30	1	Patch1

Full discourse4 posts

Upwind Security MDR@UpwindMDR136d
Disclosure
🚨 Critical - Multiple Vulnerabilities Disclosed in Altium Enterprise Server (CVE-2026-11429, CVE-2026-11423, CVE-2026-11419, CVE-2026-11420, CVE-2026-11414) A cascade of severe flaws has been disclosed affecting Altium Enterprise Server, including unauthenticated path traversal and hard-coded cryptographic keys. Attackers can exploit these vulnerabilities to read/write arbitrary files, bypass authentication, and achieve full Remote Code Execution (RCE). 👉 Pre-auth RCE & data exposure risks | Altium 365 cloud deployments are largely mitigated or remediated, but self-managed Altium Enterprise Server instances must patch immediately.
Post summary
Multiple critical vulnerabilities (CVE‑2026‑11429, 11423, 11419, 11420, 11414) in Altium Enterprise Server allow path traversal, key exposure, and full RCE, and customers are urged to patch immediately.
00010108
207 followersView on X
DFIR Lab@DFIR_Lab82d
Patch
🚨 HIGH: CVE-2026-11419 (CVSS 8.8) - Path traversal in Altium Enterprise Server allows authenticated attackers to write arbitrary files, leading to RCE. On-prem deployments affected. Patch immediately. #CVE #Vulnerability #PatchNow https://t.co/31C1TDyeZU
Post summary
The tweet alerts to CVE‑2026‑11419, a Path Traversal flaw that permits authenticated attackers to write files and achieve Remote Code Execution, and urges users to apply the available patch immediately.
0000054
98 followersView on X
CVE@CVEnew136d
Disclosure
CVE-2026-11419 A path traversal vulnerability exists in the Altium Enterprise Server Vault Service UploadController due to improper validation of a user-controlled path component in… https://www.cve.org/CVERecord?id=CVE-2026-11419
Post summary
The text announces a new path traversal vulnerability in Altium Enterprise Server Vault Service.
00000146
57.6K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds136d
Disclosure
CVE-2026-11419 Path Traversal in Altium Enterprise Server Vault Service UploadCo... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-11419 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
The post announces CVE‑2026‑11419 as a path‑traversal vulnerability in Altium Enterprise Server Vault Service, linking to detailed vulnerability information.
0000048
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	altium	on-prem_enterprise_server	-	-	-

Explore more

Back to dashboard altium CVEs on-prem_enterprise_server vulnerabilities

What researchers are saying

CVE-2026-11419

Upwind Security MDR[verified]@UpwindMDRDisclosure

Multiple critical vulnerabilities (CVE‑2026‑11429, 11423, 11419, 11420, 11414) in Altium Enterprise Server allow path traversal, key exposure, and full RCE, and customers are urged to patch immediately.

DFIR Lab[verified]@DFIR_LabPatch

The tweet alerts to CVE‑2026‑11419, a Path Traversal flaw that permits authenticated attackers to write files and achieve Remote Code Execution, and urges users to apply the available patch immediately.

CVE@CVEnewDisclosure

The text announces a new path traversal vulnerability in Altium Enterprise Server Vault Service.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The post announces CVE‑2026‑11419 as a path‑traversal vulnerability in Altium Enterprise Server Vault Service, linking to detailed vulnerability information.