External risk intelligence

Altium Server and Cloud Unauthenticated Arbitrary File Write Leading to RCE.

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-11429

The vulnerability exists in an enterprise server and cloud service, which are typically deployed as internet-facing platforms for collaboration and file management. Because the service handles external file uploads and is designed for enterprise-wide access, it is commonly exposed as an internet-accessible service or web application.

Path Traversal

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This security advisory concerns a critical vulnerability in Altium's Vault Service that allows unauthenticated attackers to execute arbitrary code on affected servers. The flaw enables attackers to upload malicious files without needing credentials, potentially leading to system compromise. While Altium Enterprise Server has been patched, the issue is addressed at the service level for Altium 365 cloud offerings.

Unauthenticated code execution on Altium servers.
Critical vulnerability impacts enterprise collaboration platforms.
Confirm relevance and exposure for Altium services.

Attack Path

How an attacker could exploit the issue

An attacker can upload a specially crafted file to a vulnerable endpoint in the Vault Service, which is shared by Altium products. This allows them to write arbitrary files to the server, even before authentication is verified. If this written file is later executed by the service, it can lead to remote code execution.

No authentication or prior system knowledge needed.
Vulnerable file upload endpoint.
Remote code execution under service account.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to write arbitrary files to the server's file system. When supported by the advisory, this could lead to remote code execution if the attacker can place executable content in a location that is later processed by the service.

Asset at risk: Service account and its privileges.
Exposure: Unauthenticated file upload to any location.
Consequence: Remote code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Altium Enterprise Server and Altium 365 platforms are affected by this vulnerability, meaning platform owners, infrastructure teams, and potentially vendor management teams are responsible for remediation. The immediate first step is to identify all instances of the affected software, determine their exposure and criticality, and confirm ownership before planning mitigation or patching activities.

Platform owners and infrastructure teams.
Verify deployment reachability and criticality.
Plan and execute remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Altium Enterprise Server and Altium 365?

These are collaborative platforms used by engineering and design teams to manage electronic product development. They provide centralized storage, file management, and version control for project data. The vulnerability resides in their shared Vault Service, which acts as the backend component responsible for handling data uploads and service-level interactions within these environments.

What does CVE-2026-11429 mean in plain English?

This is a security flaw characterized by improper handling of file paths (CWE-22) and missing authentication for critical functions (CWE-306). Essentially, the software fails to check if a user is allowed to upload files or where those files are being saved. Because the system performs this write operation before verifying the user's identity, an attacker can bypass security controls to place malicious files anywhere the server has write permissions.

How can an attacker trigger this vulnerability?

An attacker triggers the bug by sending a specially crafted request to specific endpoints in the Vault Service. Because the system processes these requests before checking for credentials, no prior knowledge of the system or user accounts is required. It is important to note that simply accessing the server does not trigger the bug; the attacker must intentionally submit a file with a malicious path component to force the software to write that file to an unauthorized location.

Is my instance at risk according to Halo Surface Signal?

Halo Surface Signal identifies this as a high-priority risk because Altium Enterprise Server and Altium 365 are designed to be collaborative, internet-facing platforms. Since these services are often accessible over the network to facilitate remote engineering work, they are commonly exposed. You should consider your instance at risk if it is reachable via the public internet or accessible from untrusted network segments.

What are the first steps to address this issue?

Begin by inventorying your deployment to confirm if you are running an affected version of Altium Enterprise Server or utilizing Altium 365. For on-premises Enterprise Server, verify if you are on version 8.1.1 or later, which includes the fix. For Altium 365, the provider has addressed the issue at the service level. If you are running an older on-premises version, prioritize upgrading immediately and restricting network access until the update is applied.

References

www.altium.com/platform/security-compliance/security-advisories

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.