Which versions of Altium Enterprise Server are affected by CVE-2026-11420?

Altium Enterprise Server's Network Installation Service (NIS) contains a critical unauthenticated remote code execution vulnerability (CVE-2026-11420, CVSS 10.0) allowing attackers to execute…. A patch is available.

How to fix or mitigate CVE-2026-11420?

Within 24 hours: Identify all Altium Enterprise Server instances running the NIS component and verify network accessibility; immediately isolate internet-facing or untrusted-network-adjacent systems from the public internet if operationally feasible. Within 7 days: Implement strict firewall rules restricting NIS port access to authorized networks only, deploy network-based detection for suspicious file operations, and enable comprehensive audit logging for all file read/write activity on Altium servers. Within 30 days: Monitor Altium security advisories for patch releases with daily checks; develop and execute a vendor communication plan to obtain interim guidance or emergency fixes; initiate procurement and testing of patched versions for production deployment.

Altium Enterprise Server CVE-2026-11420

Q: What is the CVSS score of CVE-2026-11420?

CVE-2026-11420 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

EUVD-2026-34914 CRITICAL

Path Traversal (CWE-22)

2026-06-05 4760f414-e1ae-4ff1-bdad-c7a9c3538b79

GHSA-q58x-mgvc-jhw9

Path Traversal RCE On Prem Enterprise Server

10.0

CVSS 4.0 · Vendor: 4760f414-e1ae-4ff1-bdad-c7a9c3538b79

Severity by source

Vendor (4760f414-e1ae-4ff1-bdad-c7a9c3538b79) PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (4760f414-e1ae-4ff1-bdad-c7a9c3538b79) · only source for this CVE.

CVSS VectorVendor: 4760f414-e1ae-4ff1-bdad-c7a9c3538b79

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 05, 2026 - 22:01 EUVD

Analysis Generated

Jun 05, 2026 - 20:31 vuln.today

DescriptionCVE.org

Two path traversal vulnerabilities in the Network Installation Service (NIS) of Altium Enterprise Server allow an unauthenticated network attacker to write arbitrary files to any writable location on the server filesystem and to read package archive files from the server. No authentication, session, or credentials are required.

Because content-controlled files can be written to web-accessible directories, or used to overwrite application binaries or configuration files, exploitation can be escalated to remote code execution in the context of the service account, and can disclose deployment package contents. Altium 365 cloud deployments are not affected, as the Network Installation Service is not part of the cloud offering.

AnalysisAI

Unauthenticated arbitrary file write and read in the Network Installation Service (NIS) component of Altium Enterprise Server enables remote attackers to overwrite binaries or configuration, drop content into web-accessible directories, and exfiltrate package archives - escalating to remote code execution as the service account. The CVSS 4.0 score of 10.0 (AV:N/AC:L/PR:N/UI:N with high impact across confidentiality, integrity, availability and scope) reflects a worst-case unauthenticated network primitive. No public exploit identified at time of analysis, and Altium 365 cloud deployments are explicitly out of scope.

Technical ContextAI

The flaw resides in the Network Installation Service (NIS), an on-premises component of Altium Enterprise Server used to distribute installation/deployment packages to client workstations across an engineering network. Two CWE-22 path traversal weaknesses in the NIS request handlers fail to canonicalize or constrain user-supplied paths, so attacker-controlled '..' sequences (or absolute paths) reach the underlying filesystem APIs on both write and read code paths. Because NIS runs as a privileged Windows service account with broad filesystem rights and typically co-locates with the Altium web UI directories, an attacker can both stage payloads into webroot/binary locations and harvest proprietary deployment archives. CPE data was not supplied with this submission, so exact affected versions must be confirmed from the vendor advisory.

RemediationAI

Apply the vendor-released update for Altium Enterprise Server as soon as it is published - consult https://www.altium.com/platform/security-compliance/security-advisories for the exact fixed build (specific version not provided in the input data, so do not assume a number). Until patched, the most effective compensating control is to restrict network reachability of the NIS endpoint to a trusted management segment via host firewall or network ACL, since the service has no authentication layer to harden; this will break Altium client installation workflows for users outside that segment and should be coordinated with engineering IT. As a secondary mitigation, monitor the NIS service account's filesystem for unexpected writes into webroot, Program Files, or service configuration directories, and alert on creation of executable or scripting files there. Migrating eligible workloads to Altium 365 cloud avoids the vulnerable component entirely but is a significant operational change rather than a short-term fix.