PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-14439 Altium CVE debrief

CVE-2026-14439 is a path traversal vulnerability in the Git Service component shared by Altium Enterprise Server and Altium 365. An authenticated user with basic git access can move arbitrary files outside the intended repository area, potentially leading to remote code execution under the Git Service account. This vulnerability could allow attackers to place malicious script content into directories where it will be executed by the service. Multi-tenant Altium 365 deployments may be particularly vulnerable to this issue.

Vendor
Altium
Product
Altium Enterprise Server
CVSS
CRITICAL 9.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-01
Original CVE updated
2026-07-20
Advisory published
2026-07-01
Advisory updated
2026-07-20

Who should care

Users of Altium Enterprise Server and Altium 365 should be aware of this vulnerability and take steps to mitigate it. Multi-tenant Altium 365 deployments may be particularly vulnerable. Operators, administrators, and security teams responsible for these systems should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance.

Technical summary

The Git Service component in Altium Enterprise Server and Altium 365 is vulnerable to a path traversal attack. An authenticated user can manipulate file paths to move arbitrary files outside the repository area. This can be used to place attacker-controlled script content into directories where it will be executed by the service, leading to remote code execution. The vulnerability exists due to insufficient validation of user-supplied paths during post-clone file-manipulation operations.

Defensive priority

High

Recommended defensive actions

  • Update Altium Enterprise Server to version 8.1.1 or later
  • Apply service-level remediation for Altium 365
  • Restrict git access to trusted users
  • Monitor for suspicious file system activity
  • Implement additional security controls around the Git Service account
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-01T23:16:51.800Z and last modified on 2026-07-20T23:16:55.490Z. The NVD entry is currently Deferred. The vulnerability affects Altium Enterprise Server and Altium 365, specifically the Git Service component. Evidence is limited to public CVE and NVD information.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-14439 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-14439

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-14439 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-14439

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://www.altium.com/platform/security-compliance/security-advisories

    4760f414-e1ae-4ff1-bdad-c7a9c3538b79

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.