CVE-2026-14439 Altium CVE debrief

Who should care

Users of Altium Enterprise Server and Altium 365 should be aware of this vulnerability and take steps to mitigate it. Multi-tenant Altium 365 deployments may be particularly vulnerable. Operators, administrators, and security teams responsible for these systems should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance.

Technical summary

The Git Service component in Altium Enterprise Server and Altium 365 is vulnerable to a path traversal attack. An authenticated user can manipulate file paths to move arbitrary files outside the repository area. This can be used to place attacker-controlled script content into directories where it will be executed by the service, leading to remote code execution. The vulnerability exists due to insufficient validation of user-supplied paths during post-clone file-manipulation operations.

Defensive priority

High

Recommended defensive actions

• Update Altium Enterprise Server to version 8.1.1 or later
• Apply service-level remediation for Altium 365
• Restrict git access to trusted users
• Monitor for suspicious file system activity
• Implement additional security controls around the Git Service account
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-01T23:16:51.800Z and last modified on 2026-07-20T23:16:55.490Z. The NVD entry is currently Deferred. The vulnerability affects Altium Enterprise Server and Altium 365, specifically the Git Service component. Evidence is limited to public CVE and NVD information.

Official resources