Altium 365 CVE-2026-9152

The attacker must be able to reach the Altium 365 cloud SearchService over the network and must reference (know or guess) the target workspace's identifier - that workspace ID is the concrete prerequisite. Exploitation targets the legacy SOAP SearchService endpoint specifically; the modern authenticated interfaces are not the vector. No authentication, session token, or user interaction is required (CVSS PR:N/UI:N), and no non-default configuration toggle is needed - the exposed legacy endpoint is the default-affected surface for cloud tenants. Limiting factors: only Altium 365 cloud is affected (on-premise Altium Enterprise Server is immune), impact is confined to the search index and cannot alter or read the underlying vault data, and the attacker needs a valid workspace identifier to target a specific tenant rather than blindly compromising all data.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with high vulnerable- and subsequent-system impacts) yields the maximum 10.0, and SSVC reinforces this with Automatable:yes and Technical Impact:total, so from a metric standpoint this is a top-priority network-reachable, unauthenticated bug. Counterbalancing this, the EPSS score is very low (0.07%, 20th percentile), SSVC Exploitation is 'none', it is not on CISA KEV, and no POC is referenced - signals that observed, in-the-wild exploitation is currently absent. The scores are also somewhat inflated relative to the described impact: the vendor rates confidentiality/integrity/availability all High, yet the description explicitly scopes the effect to the search index only, not the underlying vault data, so real integrity/availability damage is bounded to search functionality rather than design source. The genuine priority driver is the trivial exploitability (no auth, low complexity, automatable) and cross-tenant data disclosure in a shared SaaS environment; the tempering factor is that damage does not reach vault contents and no active exploitation is evident. Because it is a single-tenant-to-multi-tenant cloud service, remediation is largely vendor-controlled, which lowers customer-side urgency compared with an on-prem patch scramble.

An attacker who has obtained or guessed a victim organization's Altium 365 workspace identifier sends crafted, unauthenticated SOAP requests to the legacy SearchService endpoint over the internet. With no login required, they enumerate the workspace's indexed component libraries, project and folder names, and user metadata, then poison or delete index entries to corrupt search results for that tenant. No POC is publicly referenced, but the attack requires only network access and knowledge of the workspace ID, and SSVC rates it automatable.