CVE-2026-11414

CriticalCVSS 9.8/10Last modified Oct 26, 2026

Description

A hard-coded cryptographic key is used by Altium Enterprise Server to sign file download URLs in the Vault service. Because the key is identical across all installations, an unauthenticated network attacker who can reach the server can forge valid download signatures and retrieve files from the Vault storage area without any authentication, session, or credentials.

A separate path traversal vulnerability in the same download endpoint allows the configured storage root to be escaped, enabling reads of arbitrary files on the server filesystem. Combined, these issues allow an unauthenticated attacker to obtain sensitive server configuration and key material, which can lead to full server compromise. The vulnerability can be chained with CVE-2026-9152 to enumerate and bulk-download stored content. Altium 365 cloud deployments are not impacted in practice, as file storage uses object storage rather than the local filesystem.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22 CWE-798

Affected software

Vendor	Product	Versions
Altium	Altium Enterprise Server	< 8.1.1

References

https://www.altium.com/platform/security-compliance/security-advisoriesVendor Advisory

Timeline

Published: Jun 5, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1141408.8The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4.0 until 7.17.2, Ext CVE-2026-1141418.7toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse() compiler's addTableArray() function in lib/compiler CVE-2026-1141428.8toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() can write attacker-controlled properties to Object.prot CVE-2026-1141438.7toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() repeatedly slices and rejoins every path prefix in lib/CVE-2026-1141447.5toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() passes unbounded hexadecimal, octal, binary, and decima CVE-2026-1141457.5GitPython is a python library used to interact with Git repositories. Prior to 3.2.1, create_submodule() in git/objects/submodule/base.py ac CVE-2026-1141469.0Incorrect authorization in ASP.NET Core allows an authorized attacker to elevate privileges over a network.CVE-2026-1141477.5Missing release of memory after effective lifetime in ASP.NET Core allows an unauthorized attacker to deny service over a network.CVE-2026-1141487.8Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.CVE-2026-1141497.5Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.CVE-2026-1141505.9Use of uninitialized resource in ASP.NET Core allows an unauthorized attacker to disclose information over a network.CVE-2026-1141518.8Deserialization of untrusted data in Visual Studio allows an unauthorized attacker to execute code over a network.