Altium Enterprise Server CVE-2026-11431

The attacker must hold valid low-privileged credentials to the Altium Projects Service (CVSS PR:L confirms authentication is required, with no user interaction needed), and must be able to reach the Projects Service download endpoint over the network. For direct exploitation of on-prem Altium Enterprise Server, network reachability to the server and any authenticated account suffice; for the cloud-side endpoint on Altium 365, exploitation additionally requires chaining with CVE-2026-11424 to reach the vulnerable handler. Exploitation is limited by the requirement for a valid account and by the patch state - Enterprise Server installations already on 8.1.1 or later are not exploitable, and Altium 365 has been service-side remediated, so only un-upgraded on-prem Enterprise Server deployments remain at risk.

CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N with subsequent-system confidentiality impact SC:H yields 8.3 (High) - the elevated score is driven by the cross-system credential leak, not by integrity or availability loss. PR:L confirms a valid low-privileged account is required, which materially limits opportunistic exploitation, but Altium Enterprise Server typically permits broad internal user provisioning, so the bar in practice is low for an insider or a phished account. There is no public exploit identified at time of analysis, no EPSS score provided, and the CVE is not on the CISA KEV list, so this is not confirmed actively exploited; however, the vendor explicitly documents a chain with CVE-2026-11424 that reaches the cloud-side endpoint, meaning Altium 365 tenants faced a realistic pre-patch exposure even without local credentials. The credential-material disclosure on a multi-tenant SaaS is the dominant risk signal here - treat as a high priority for Altium 365 customers despite the absence of in-the-wild reports.

An attacker obtains or phishes any low-privileged Altium account, then issues a crafted request to the Projects Service download endpoint with traversal sequences in the path parameter, retrieving the service configuration directory as an archive. Extracted credentials are then reused to pivot into adjacent services - on Altium 365 this may yield cross-tenant access by chaining CVE-2026-11424 to reach the cloud endpoint without local Enterprise Server access. No public PoC has been published, but the bug class is straightforward to weaponize once an authenticated session is available.