Altium Enterprise Server CVE-2026-11420

Exploitation requires only network reachability to the Altium Enterprise Server's Network Installation Service (NIS) endpoint - no credentials, session, user interaction, or non-default configuration are needed, since NIS is a standard component of on-premises Altium Enterprise Server installations. The single concrete limiting factor is deployment model: Altium 365 cloud customers are not affected because NIS is not part of the cloud offering, so only on-premises installs with NIS reachable from the attacker's network position are exploitable. Successful write-to-RCE escalation additionally depends on the NIS service account having write permission to a directory whose contents are executed by another component (web root, application binary path, or auto-loaded configuration) - which the vendor description confirms is the realistic outcome.

Every signal points to maximum urgency: CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:N/UI:N with VC/VI/VA:H and SC/SI/SA:H - fully unauthenticated, low complexity, no user interaction, and scope change indicating impact beyond the vulnerable component. The primitive is arbitrary file write to any writable path plus arbitrary read of package archives, which the description itself documents as escalatable to RCE in the service-account context - effectively pre-auth RCE on internet- or LAN-reachable NIS endpoints. EPSS and CISA KEV status were not provided in the input, so probabilistic exploitation likelihood and confirmation of active in-the-wild use are unknown; however, the simplicity of path traversal exploitation and the high-value target (engineering IP, PCB designs, supply-chain deployment packages) make targeting by both opportunistic and motivated actors very plausible. Treat this as a top-priority patch regardless of missing EPSS/KEV signals - the technical impact and ease of exploitation alone justify immediate action.

An attacker with network reachability to the Altium Enterprise Server (e.g., an unauthenticated user on the corporate LAN, a compromised VPN client, or an exposed internet-facing instance) sends a crafted NIS request containing a traversal sequence to write a webshell into the server's web-accessible directory, then requests that shell to gain code execution as the NIS service account. In a quieter scenario, the same attacker uses the read primitive to download proprietary deployment package archives - exposing internal software, license material, and PCB/design IP - without leaving execution artifacts. No public exploit was identified in the supplied intelligence, but path traversal is trivial to weaponize once the endpoint and parameter are known.