CVE-2026-11420
CWE-22Published: June 5, 2026· Updated: Jun 5, 2026
Official Description
Two path traversal vulnerabilities in the Network Installation Service (NIS) of Altium Enterprise Server allow an unauthenticated network attacker to write arbitrary files to any writable location on the server filesystem and to read package archive files from the server. No authentication, session, or credentials are required.
Because content-controlled files can be written to web-accessible directories, or used to overwrite application binaries or configuration files, exploitation can be escalated to remote code execution in the context of the service account, and can disclose deployment package contents. Altium 365 cloud deployments are not affected, as the Network Installation Service is not part of the cloud offering.
Risk Analysis
This critical vulnerability in Altium Enterprise Server's Network Installation Service (NIS) allows unauthenticated remote attackers to write arbitrary files to any writable location and read package archive files. This can lead to remote code execution and disclosure of deployment package contents. With a CVSS score of 10.0, this is an urgent and severe threat.
No public exploit is currently known for this remotely exploitable vulnerability. No authentication or credentials are required for exploitation.
Apply the latest security updates for Altium Enterprise Server to address these path traversal vulnerabilities. Ensure that the Network Installation Service is properly secured and restricted.
Technical Analysis
CVE-2026-11420 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.
CVSS v3.1 Vector Breakdown
Exploit & PoC Resources
All References (1)
Quick Facts
Related CVEs (CWE-22)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2026-11420 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts