CVE-2026-11423Disclosure

LOWCVSS 9.4 · CRITICAL

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A path traversal vulnerability exists in the Altium Enterprise Server Collaboration Service due to improper handling of user-supplied filenames in the MCAD and Simulation file download flows. A regular authenticated user can submit a collaboration message containing a crafted filename, which is later used to construct the download path on the server without validation, allowing arbitrary files to be read from the server filesystem. Because the readable files include the server's master configuration, which stores credentials for privileged accounts, exploitation can lead to authenticating as a system administrator and gaining full control of the server. Altium 365 cloud deployments are not affected.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

https://www.altium.com/platform/security-compliance/security-advisories

Weakness type (CWE)

CWE-22CWE-269

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
3 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 3 signals
Disclosure: 2 classified signals
General: 1 classified signal
Peaked at 2 mentions on most recent observed day (2026-06-06)
3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d

Signal classification2 categories

Disclosure

266.7%

General

133.3%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-05	1	General1
2026-06-06	2	Disclosure2

Full discourse3 posts

Upwind Security MDR@UpwindMDR136d
Disclosure
🚨 Critical - Multiple Vulnerabilities Disclosed in Altium Enterprise Server (CVE-2026-11429, CVE-2026-11423, CVE-2026-11419, CVE-2026-11420, CVE-2026-11414) A cascade of severe flaws has been disclosed affecting Altium Enterprise Server, including unauthenticated path traversal and hard-coded cryptographic keys. Attackers can exploit these vulnerabilities to read/write arbitrary files, bypass authentication, and achieve full Remote Code Execution (RCE). 👉 Pre-auth RCE & data exposure risks | Altium 365 cloud deployments are largely mitigated or remediated, but self-managed Altium Enterprise Server instances must patch immediately.
Post summary
Multiple critical CVEs were disclosed for Altium Enterprise Server, exposing path traversal, hard‑coded keys, and full RCE; the vendor requires immediate patching of self‑managed instances, with no PoC or active exploitation reported.
00010108
207 followersView on X
CVE@CVEnew136d
Disclosure
CVE-2026-11423 A path traversal vulnerability exists in the Altium Enterprise Server Collaboration Service due to improper handling of user-supplied filenames in the MCAD and Simula… https://www.cve.org/CVERecord?id=CVE-2026-11423
Post summary
Altium Enterprise Server Collaboration Service suffers from a path traversal flaw (CVE‑2026‑11423) due to improper filename handling.
00000122
57.6K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds137d
General
CVE-2026-11423 Path Traversal in Altium Enterprise Server Collaboration ... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-11423 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2
Post summary
A brief mention of a path traversal vulnerability (CVE‑2026‑11423) in Altium Enterprise Server Collaboration, with no details on exploitation or mitigation.
0000051
4.0K followersView on X

Explore more

Back to dashboard