Altium Enterprise Server CVE-2026-11423

Attacker must hold valid credentials for a standard authenticated user on an on-premises Altium Enterprise Server running a version below 8.1.1, and must be able to reach the Collaboration Service over the network to submit a collaboration message and invoke the MCAD or Simulation file-download flow with a crafted filename. No user interaction by a victim is required (UI:N) and no special non-default configuration is needed - the vulnerable download paths are part of standard Collaboration Service functionality. Exploitation is limited by the PR:L authentication requirement and by deployment model: Altium 365 SaaS tenants are explicitly not affected, so only self-hosted servers are at risk.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N with high confidentiality, integrity, and availability impact to both vulnerable and subsequent systems (VC/VI/VA:H and SC/SI/SA:H) drives the 9.4 score, and the scenario is plausible: any holder of a standard user account on the server can read the master configuration and then authenticate as an administrator, so the scope-change rating is well-grounded rather than inflated. EPSS and CISA KEV data are not provided in the input, and no public PoC is referenced, so exploitation is currently unproven in the wild - the threat is best described as high-impact but not yet observed. Because the disclosure originated with the vendor and a fixed release is already available, defenders should treat this as a near-term patching priority for any on-prem deployment despite the absence of active-exploitation signals.

An attacker with any valid Altium Enterprise Server account (for example a contractor or compromised engineer credential) posts a collaboration message whose MCAD or Simulation filename field contains traversal sequences pointing at the server's master configuration file. The Collaboration Service returns the configuration contents via the standard download endpoint, exposing administrator credentials, which the attacker then uses to log in with full admin rights and pivot to all hosted design data. No public exploit identified at time of analysis, but the attack only requires standard HTTP requests and one low-privileged account, so weaponization is straightforward.