External risk intelligence

Altium Enterprise Server Path Traversal Leads to Full System Control

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-11423

The Altium Enterprise Server is a collaboration service deployed within corporate environments. While these services often sit behind internal firewalls or VPNs, they are frequently made accessible to remote teams, partners, or via web portals, making internet reachability possible depending on the organization's specific network architecture and remote access requirements.

Path Traversal

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security flaw in the Altium Enterprise Server Collaboration Service could allow an authenticated user to access sensitive server files, including administrator credentials, potentially leading to full control of the system. This issue does not affect Altium 365 cloud deployments.

Flaw lets authenticated users steal server credentials.
Critical access grants full server control.
Confirm if on-premises server is affected.

Attack Path

How an attacker could exploit the issue

An authenticated user can exploit this vulnerability by sending a specially crafted filename within a collaboration message. The server improperly processes this filename when constructing download paths for MCAD and Simulation files. This allows an attacker to read sensitive files from the server's filesystem, including configuration files that contain privileged account credentials, potentially granting administrative access and full server control.

Authenticated user, network access.
Crafting filenames in download requests.
Full administrative control of server.

Live Threat

Current exploitation, exposure, and threat context

A path traversal vulnerability in Altium Enterprise Server's file download feature could allow authenticated users to read arbitrary files from the server. This is possible when a specially crafted filename is submitted in a collaboration message, leading to unvalidated path construction for file downloads. If the vulnerable server configuration is accessible externally and the master configuration file is targeted, an attacker could potentially gain administrative control of the server.

Server configuration and credentials.
Crafted filename in download requests.
Full server control could be achieved.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Altium Enterprise Server Collaboration Service requires immediate attention from infrastructure and security teams responsible for managing on-premises deployments. The first step is to identify all instances, confirm their network exposure and criticality, and then assign ownership to assess the risk and plan remediation.

Ownership: Infrastructure or platform teams.
Verify: Server reachability and critical asset status.
Action: Plan and coordinate remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Altium Enterprise Server Collaboration Service?

It is an on-premises platform used by engineering teams to manage design data, facilitate collaboration, and handle complex simulation and MCAD workflows. Unlike cloud-based tools, this software is hosted directly within a company's own infrastructure to keep sensitive design files and project configurations under local control.

What does path traversal mean in CVE-2026-11423?

This vulnerability, classified as CWE-22, occurs when the software fails to sanitize file paths provided by a user. By submitting a specially crafted filename during a download request, an attacker can trick the server into looking outside the intended directory. In this case, it allows them to read sensitive files, such as configuration data that stores administrative credentials, from the server's filesystem.

How does an attacker trigger this vulnerability?

An attacker needs an authenticated account to send a collaboration message containing a manipulated filename. The server uses this malicious name to construct a file path without proper validation. Notably, this flaw is specific to the MCAD and Simulation file download flows; standard operations that do not involve these specific download processes are not the mechanism for triggering this path traversal.

Do I need to worry if my server is internal?

Halo Surface Signal notes that while many such servers are shielded by firewalls, they are often exposed to support remote teams or partners. Even if you consider your deployment internal, any access provided via VPNs or web portals increases the risk. You should evaluate your specific network architecture to determine if the server is reachable by someone who could provide the required authentication to launch an attack.

What should I do if I run Altium Enterprise Server?

Immediately identify all on-premises instances of the software within your organization. Once located, verify their current network reachability and confirm that they are not Altium 365 cloud deployments, which are unaffected. Assign responsibility to your infrastructure or platform teams to assess the risk, monitor for further security guidance from Altium, and prioritize applying the necessary remediations.

References

www.altium.com/platform/security-compliance/security-advisories

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.