CVE-2026-11420

Two path traversal vulnerabilities in the Network Installation Service (NIS) of Altium Enterprise Server allow an unauthenticated network attacker to write arbitrary files to any writable location on the server filesystem and to read package archive files from the server. No authentication, session, or credentials are required. Because content-controlled files can be written to web-accessible directories, or used to overwrite application binaries or configuration files, exploitation can be escalated to remote code execution in the context of the service account, and can disclose deployment package contents. Altium 365 cloud deployments are not affected, as the Network Installation Service is not part of the cloud offering.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.altium.com/platform/security-compliance/security-advisories	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:altium:on-prem_enterprise_server:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-06-05 20:17

Updated : 2026-07-23 07:10

NVD link : CVE-2026-11420

Mitre link : CVE-2026-11420

CVE.ORG link : CVE-2026-11420

JSON object : View

Products Affected

altium

on-prem_enterprise_server

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2026-11420", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-11420", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-05T20:29:39.377787Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 10.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "affectedData": [{"vendor": "Altium", "modules": ["Network Installation Service (NIS)"], "product": "Altium Enterprise Server", "versions": [{"status": "affected", "version": "0", "lessThan": "8.1.1", "versionType": "semver"}], "platforms": ["Web"], "defaultStatus": "unaffected"}]}], "published": "2026-06-05T20:17:29.350", "references": [{"url": "https://www.altium.com/platform/security-compliance/security-advisories", "tags": ["Vendor Advisory"], "source": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "Two path traversal vulnerabilities in the Network Installation Service (NIS) of Altium Enterprise Server allow an unauthenticated network attacker to write arbitrary files to any writable location on the server filesystem and to read package archive files from the server. No authentication, session, or credentials are required.\n\n\n\n\nBecause content-controlled files can be written to web-accessible directories, or used to overwrite application binaries or configuration files, exploitation can be escalated to remote code execution in the context of the service account, and can disclose deployment package contents. Altium 365 cloud deployments are not affected, as the Network Installation Service is not part of the cloud offering."}, {"lang": "es", "value": "Dos vulnerabilidades de salto de ruta en el Servicio de Instalaci\u00f3n de Red (NIS) de Altium Enterprise Server permiten a un atacante de red no autenticado escribir archivos arbitrarios en cualquier ubicaci\u00f3n con permisos de escritura en el sistema de archivos del servidor y leer archivos de paquetes archivados del servidor. No se requiere autenticaci\u00f3n, sesi\u00f3n ni credenciales.\n\nDebido a que los archivos controlados por contenido pueden escribirse en directorios accesibles por la web, o usarse para sobrescribir binarios de aplicaciones o archivos de configuraci\u00f3n, la explotaci\u00f3n puede escalarse a ejecuci\u00f3n remota de c\u00f3digo en el contexto de la cuenta de servicio, y puede divulgar el contenido de los paquetes de despliegue. Las implementaciones en la nube de Altium 365 no se ven afectadas, ya que el Servicio de Instalaci\u00f3n de Red no forma parte de la oferta en la nube."}], "lastModified": "2026-07-23T07:10:00.113", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:altium:on-prem_enterprise_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0EA274E8-BCF0-41F5-A4DD-3855F0776A78", "versionEndExcluding": "8.1.1"}], "operator": "OR"}]}], "sourceIdentifier": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79"}