Altium Enterprise Server CVE-2026-92808

Exploitation requires network reachability to the UnifiedLogin service of an on-premises Altium Enterprise Server; no authentication, no privileges, and no user interaction are needed against a default on-prem deployment. The chain further depends on the internal configuration/credential endpoint being present and gated only by a request-locality check - which the server-originated forged request satisfies by design. The primary LIMITING factor is deployment mode: Altium 365 cloud deployments are explicitly NOT affected because the vulnerable endpoint is disabled in cloud mode, so only self-hosted/on-premises installations are exposed.

This is a genuine top-priority vulnerability, not a high-CVSS-but-low-risk artifact. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, unauthenticated, low-complexity exploitation with no user interaction, and the vendor scores full base-metric impact including scope change to subsequent systems (VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) for a 10.0. The description supports this: an unauthenticated SSRF chains into an unauthenticated internal credential-disclosure endpoint (whose only 'auth' is a locality check that the server-originated forged request trivially satisfies), yielding stored credentials, an admin session, and full server compromise - a clean, self-contained exploit chain rather than a speculative one. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or automated mass-scanning yet; the signals here are architectural (a described, credible full-compromise chain) rather than telemetry-based. The one meaningful risk reducer is deployment scope: Altium 365 cloud tenants are explicitly unaffected because the vulnerable endpoint is disabled in cloud mode, so real-world exposure is limited to on-premises Altium Enterprise Server installs. The CVSS network/unauth signals and the description are fully consistent - no conflict to flag - but exploitation-probability data (EPSS/KEV/POC) is simply absent, not low.

An unauthenticated attacker reachable over the network sends a request to the UnifiedLogin service that coerces the server into making an outbound HTTP request to an internal-only endpoint exposing configuration and credential material. Because the request originates from the server process, the endpoint's locality-only check passes, returning stored credentials that the attacker replays to open an administrative session and fully compromise the server. No public exploit code has been identified at time of analysis, but the chain is fully described by the vendor and requires no authentication or user interaction.