CVE-2026-11420
Analyzed Analyzed - Analysis Complete
Path Traversal in Altium Enterprise Server NIS

Publication date: 2026-06-05

Last updated on: 2026-06-16

Assigner: Altium

Description
Two path traversal vulnerabilities in the Network Installation Service (NIS) of Altium Enterprise Server allow an unauthenticated network attacker to write arbitrary files to any writable location on the server filesystem and to read package archive files from the server. No authentication, session, or credentials are required. Because content-controlled files can be written to web-accessible directories, or used to overwrite application binaries or configuration files, exploitation can be escalated to remote code execution in the context of the service account, and can disclose deployment package contents. Altium 365 cloud deployments are not affected, as the Network Installation Service is not part of the cloud offering.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-05
Last Modified
2026-06-16
Generated
2026-06-27
AI Q&A
2026-06-06
EPSS Evaluated
2026-06-25
NVD
CVE-2026-11420
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
altium on-prem_enterprise_server to 8.1.1 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability involves two path traversal issues in the Network Installation Service (NIS) of Altium Enterprise Server. An unauthenticated attacker can exploit these flaws to write arbitrary files to any writable location on the server's filesystem and read package archive files from the server without needing any authentication or credentials.

Because the attacker can write files to web-accessible directories or overwrite application binaries or configuration files, this can lead to remote code execution under the service account's privileges. Additionally, the attacker can disclose the contents of deployment packages.

It is important to note that Altium 365 cloud deployments are not affected by this vulnerability since the Network Installation Service is not part of the cloud offering.

Impact Analysis

This vulnerability can have severe impacts including unauthorized file writes and reads on the server, which can lead to remote code execution. An attacker can potentially overwrite critical application binaries or configuration files, compromising the integrity and availability of the system.

The ability to read package archive files can lead to information disclosure, exposing sensitive deployment package contents.

Overall, exploitation can result in full compromise of the affected server, loss of data confidentiality, integrity, and availability.

Compliance Impact

The vulnerability allows unauthenticated attackers to write arbitrary files and read package archives on the server, potentially leading to remote code execution and disclosure of deployment package contents.

Such unauthorized access and potential data disclosure could lead to non-compliance with standards and regulations like GDPR and HIPAA, which require protection of sensitive data and secure system access.

However, the provided information does not explicitly mention the impact on compliance with these standards.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-11420. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart