Altium 365 CVE-2026-11429

The CVE description requires an authenticated user with basic git access to the Altium Git Service and the ability to invoke the post-clone file-manipulation operations that accept user-supplied paths; without such an account the vulnerable code path is not reachable. Note a conflict with the CVSS v4.0 vector, which advertises PR:N (no privileges required) - this should be verified directly with Altium, as the description's authentication prerequisite is the more conservative limiter for defensive planning. On Altium 365 the conditions are now moot because the service-side fix is deployed; on Altium Enterprise Server, exploitation is further limited to versions below 8.1.1 and to deployments where attackers can reach the Git Service over the network with valid credentials. No special non-default configuration is mentioned - the vulnerable post-clone behavior appears to be present in the default Git Service flow.

The signals point in different directions and should be reconciled carefully. CVSS v4.0 is rated 10.0 with AV:N/AC:L/PR:N/UI:N and full impact across the confidentiality/integrity/availability axes plus subsequent system scope (SC:H/SI:H/SA:H), reflecting the multi-tenant blast radius. However, the description explicitly states an 'authenticated user with basic git access' is required, which conflicts with the PR:N (no privileges required) value in the vector - verify with the vendor whether the vulnerable code path is actually reachable pre-authentication or whether the PR metric reflects that 'basic git access' is treated as trivially obtainable. SSVC marks Exploitation=none and Automatable=yes with Technical Impact=total, and EPSS is modest at 0.44% (63rd percentile), consistent with no public exploit identified at time of analysis and not on CISA KEV. Net assessment: a high-priority patch for any organization running Altium Enterprise Server because the technical impact is total and weaponization is plausible, but not yet evidence of mass exploitation.

An attacker who has obtained low-privilege git credentials - for example via phishing of an engineer or reuse of leaked credentials - clones a repository from the Altium Git Service and triggers the post-clone file-manipulation sequence with a destination path containing traversal segments, relocating an attacker-staged script into a directory the service subsequently executes. The script runs as the Git Service account, granting code execution on the host; on Altium 365 the same primitive could traverse into storage belonging to other tenants sharing that node. No public exploit identified at time of analysis, but the file-move primitive is straightforward enough that SSVC flagged the issue as automatable.