Which versions of Altium Enterprise Server are affected by CVE-2026-14439?

Altium Enterprise Server and Altium 365 users with git repository access can escalate privileges to execute arbitrary code as the Git Service account, threatening design intellectual property and…. A patch is available.

How to fix or mitigate CVE-2026-14439?

Within 24 hours: Inventory all Altium Enterprise Server and Altium 365 instances; audit Git Service access logs for unauthorized activity; for multi-tenant deployments, assess cross-tenant data exposure scope. Within 7 days: Disable or restrict git functionality in affected systems; implement network segmentation to limit Git Service account privileges and isolate tenant environments; engage Altium support for available workarounds. Within 30 days: Apply vendor-released patch immediately upon availability and validate in test environment; conduct forensic investigation for exploitation evidence.

Altium Enterprise Server CVE-2026-14439

Q: What is the CVSS score of CVE-2026-14439?

CVE-2026-14439 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

EUVD-2026-41210 CRITICAL

Path Traversal (CWE-22)

2026-07-01 4760f414-e1ae-4ff1-bdad-c7a9c3538b79

GHSA-m97g-7h77-r5pr

RCE Path Traversal

9.4

CVSS 4.0 · Vendor: 4760f414-e1ae-4ff1-bdad-c7a9c3538b79

Severity by source

Vendor (4760f414-e1ae-4ff1-bdad-c7a9c3538b79) PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.9 CRITICAL

Network-reachable Git Service, low complexity, requires a low-privileged authenticated git user (PR:L), no interaction; scope changed (S:C) since RCE and cross-tenant access affect resources beyond the vulnerable component, with full CIA impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (4760f414-e1ae-4ff1-bdad-c7a9c3538b79).

CVSS VectorVendor: 4760f414-e1ae-4ff1-bdad-c7a9c3538b79

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 02, 2026 - 02:01 EUVD

Analysis Generated

Jul 01, 2026 - 23:30 vuln.today

DescriptionCVE.org

A path traversal vulnerability exists in the Git Service component shared by Altium Enterprise Server and Altium 365. The service accepts a sequence of post-clone file-manipulation operations that use user-supplied paths without validation, allowing an authenticated user with basic git access to move arbitrary files outside the intended repository area.

This file-move primitive can be used to place attacker-controlled script content into directories where it is later executed by the service, resulting in remote code execution under the Git Service account. On multi-tenant Altium 365 deployments, this could have allowed access to data belonging to other tenants on the same infrastructure node. Altium Enterprise Server is fixed in 8.1.1; the issue has been remediated in Altium 365 (commercial and government cloud) at the service level.

AnalysisAI

Privilege-escalating remote code execution in the Git Service shared by Altium Enterprise Server and Altium 365 lets an authenticated user with basic git access abuse post-clone file-manipulation operations to move arbitrary files outside the repository, plant executable script content, and run code as the Git Service account. On multi-tenant Altium 365 cloud nodes this also created a cross-tenant data-exposure path. No public exploit identified at time of analysis; the CVSS 4.0 score of 9.4 (Critical) reflects full confidentiality, integrity and availability impact with only low privileges required.

Technical ContextAI

The flaw lives in a shared Git Service component that handles repository operations for both the on-premises Altium Enterprise Server and the Altium 365 cloud platform (a PCB/electronics design data-management and lifecycle system). After a clone, the service executes a sequence of file-manipulation (move) operations using user-supplied paths that are never validated or canonicalized. This is a classic CWE-22 'Improper Limitation of a Pathname to a Restricted Directory' (path traversal) issue: by embedding traversal sequences (e.g. ../) in the target path, the attacker escapes the intended repository sandbox. Because the resulting file-move primitive can drop content into a location the service later executes, the traversal is chained into code execution rather than being a simple read/write-out-of-bounds bug.

RemediationAI

For on-premises deployments, upgrade Altium Enterprise Server to version 8.1.1 (Vendor-released patch: 8.1.1), which contains the fix for the unvalidated post-clone file-move operations. Altium 365 (commercial and government cloud) customers require no action because the fix was applied at the service level by the vendor. If immediate patching of an on-premises server is not possible, reduce exposure by restricting who holds git access to trusted, authenticated users only (exploitation requires an authenticated basic-git account), limiting network reachability of the Git Service to trusted management networks, and increasing monitoring of the service account for anomalous file writes or process execution - note these are interim compensating controls that reduce, but do not eliminate, the risk and may impede legitimate collaboration. Confirm details and any additional guidance via the Altium security advisories page: https://www.altium.com/platform/security-compliance/security-advisories.