Altium Enterprise Server EUVD-2026-34899

Network reachability to the Altium Enterprise Server HTTP interface and the Vault download endpoint is the only requirement; no account, session, token, or user interaction is needed, matching PR:N/UI:N/AC:L/AT:N in the CVSS vector. Exploitation is limited to self-hosted Altium Enterprise Server installations on versions below 8.1.1 - Altium 365 SaaS tenants are not exploitable because storage is backed by object storage rather than a local filesystem, removing the path traversal target. Full server compromise (versus pure file read of Vault contents) depends on the patched host actually storing useful secrets such as HashiCorp Vault material or service credentials at filesystem paths the Altium service account can read, which the vendor description indicates is the common deployment shape.

Risk is exceptionally high and should be treated as a priority-one issue for on-premises Altium Enterprise Server operators. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with HIGH on all confidentiality, integrity, availability, and subsequent-system metrics is internally consistent with the description: no authentication, no user interaction, and the secondary-system impact reflects the documented escalation from file read to full server compromise via leaked key material. EPSS and KEV data are not provided in the intelligence feed, so exploitation probability and active in-the-wild use cannot be quantified here - absence of a KEV listing should not be read as 'not exploited' given the vulnerability was disclosed by the vendor itself. SSVC signals are not supplied, but the technical profile (network-reachable, no preconditions, automatable HMAC-forgery script, total technical impact) maps cleanly to SSVC 'Act' for any exposed instance. The main mitigating factor is deployment scope: Altium 365 SaaS customers are explicitly out of scope, narrowing real-world impact to self-hosted installations.

An external attacker who can reach the Altium Enterprise Server's HTTP interface generates a signed download URL offline using the hard-coded key (recoverable from any product copy or trial install), appends a traversal payload such as /../../etc/altium/config or /../../var/lib/hashicorp/vault to the resource path, and issues the forged request to retrieve the file unauthenticated. They then chain CVE-2026-9152 to enumerate Vault storage IDs and bulk-pull stored engineering data, and use credentials or signing material recovered from the filesystem to pivot to administrative control of the server. No public exploit code is identified at time of analysis, but the construction is trivial once the static key is extracted from the binary.