Altium On-prem_enterprise_server
7 CVEs affecting Altium On-prem_enterprise_server. Latest disclosed: 2026-06-05. Critical: 2, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-11420 | Critical | 9.8 | 2026-06-05 | Two path traversal vulnerabilities in the Network Installation Service (NIS) of Altium Enterprise Server allow an unauthenticated network attacker to write arb… |
CVE-2026-11414 | Critical | 9.8 | 2026-06-05 | A hard-coded cryptographic key is used by Altium Enterprise Server to sign file download URLs in the Vault service. Because the key is identical across all ins… |
CVE-2026-11419 | High | 8.8 | 2026-06-05 | A path traversal vulnerability exists in the Altium Enterprise Server Vault Service UploadController due to improper validation of a user-controlled path compo… |
CVE-2025-27378 | High | 8.6 | 2026-01-22 | AES contains a SQL injection vulnerability due to an inactive configuration that prevents the latest SQL parsing logic from being applied. When this configurat… |
CVE-2026-1010 | High | 8.0 | 2026-01-15 | A stored cross-site scripting (XSS) vulnerability exists in the Altium Workflow Engine due to missing server-side input sanitization in workflow form submissio… |
CVE-2025-27380 | High | 7.6 | 2026-01-22 | HTML injection in Project Release in Altium Enterprise Server (AES) 7.0.3 on all platforms allows an authenticated attacker to execute arbitrary JavaScript in… |
CVE-2025-27379 | Medium | 6.8 | 2026-01-22 | A stored cross-site scripting (XSS) vulnerability in the BOM Viewer in Altium AES 7.0.3 allows an authenticated attacker to inject arbitrary JavaScript into th… |