PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-11420 Altium CVE debrief

CVE-2026-11420 is a critical vulnerability in Altium Enterprise Server's Network Installation Service (NIS). Two path traversal vulnerabilities allow unauthenticated network attackers to write arbitrary files to any writable location on the server filesystem and read package archive files from the server. No authentication, session, or credentials are required for exploitation. The vulnerabilities can be escalated to remote code execution in the context of the service account and disclose deployment package contents. Altium 365 cloud deployments are not affected as NIS is not part of the cloud offering.

Vendor
Altium
Product
Altium Enterprise Server
CVSS
CRITICAL 10
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-05
Original CVE updated
2026-07-23
Advisory published
2026-06-05
Advisory updated
2026-07-23

Who should care

Administrators and users of Altium Enterprise Server, especially those with on-premises installations, should be aware of this critical vulnerability. The ability to write arbitrary files and read package archives without authentication makes this a high-risk vulnerability that requires immediate attention.

Technical summary

The CVSS score for CVE-2026-11420 is 10 (Critical). The vulnerability is caused by two path traversal issues in the Network Installation Service of Altium Enterprise Server. An unauthenticated attacker can exploit these vulnerabilities to write files to any writable location on the server and read package archive files. This can lead to remote code execution and disclosure of deployment package contents. The CVSS vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

Defensive priority

High

Recommended defensive actions

  • Apply patches or updates provided by Altium to fix the path traversal vulnerabilities in the Network Installation Service.
  • Review and restrict access to the Network Installation Service to prevent unauthorized access.
  • Monitor server logs for suspicious activity related to file writes and reads.
  • Consider disabling the Network Installation Service if not required.

Evidence notes

The CVE record was obtained from the official CVE.org website [cve-org]. Additional details were found on the NVD website [nvd]. A reference to the Altium security advisories page is also available [ref-4].

Sources and references

Verified primary and authoritative sources

  • CVE-2026-11420 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-11420

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-11420 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-11420

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://www.altium.com/platform/security-compliance/security-advisories

    4760f414-e1ae-4ff1-bdad-c7a9c3538b79

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.