Security Advisories

This page contains important information regarding security vulnerabilities
that could affect specific versions of Altium 365 products or services.

Report Vulnerability

Security advisories for 2026

Unauthenticated SOAP Endpoint in Altium 365 Search Service

A missing authentication vulnerability exists in the Altium 365 SearchService.

Description

A missing authentication vulnerability exists in the Altium 365 SearchService. A legacy SOAP endpoint exposes search index operations without requiring authentication, session tokens, or any form of identity verification. An unauthenticated network attacker who can reference a target workspace's identifier can interact with that workspace's search index, crossing tenant boundaries.

Successful exploitation allows reading a workspace's indexed contents (such as component data, project and folder names, and user metadata) and injecting, modifying, or deleting search index entries. These operations affect the search index only, not the underlying vault data, but they can disclose sensitive workspace information and compromise the integrity and availability of search results. Altium 365 cloud deployments are affected; on-premise Altium Enterprise Server is not affected.

CVSS: 10.0

Detail of Vulnerability: CVE Record:CVE-2026-9152

Affected Products

Product: Altium 365
Affected version: All Altium 365 cloud workspaces (commercial and government cloud
Mitigated version: Remediated at the service level (no customer action required)

Recommendations

No customer action is required. Altium remediated this issue at the service level across all Altium 365 commercial and government cloud regions.

Acknowledgements

Joris Aerts

Revision History

Revision: 1.0
Date: 20 May 2026
Description: Post new finding

Path Traversal in Altium Enterprise Server Comparison Service

A path traversal vulnerability exists in the Altium Enterprise Server ComparisonService due to missing filename sanitization in the Gerber file upload APIs.

Description

A regular authenticated workspace user can supply a crafted filename in the multipart Content-Disposition header to escape the intended temporary upload directory and write arbitrary files to any location on the server filesystem.

Because content-controlled files can be written to web-accessible directories, this can be escalated to remote code execution in the context of the service account. It can also be used to overwrite application binaries or configuration files, leading to service takeover or denial of service.

CVSS: 9.4

Detail of Vulnerability: CVE Record: CVE-2026-9102

Affected Products

Product: Altium Enterprise Server
Affected version: All versions prior to 8.0.4
Mitigated version: 8.0.4

Recommendations

Update to latest version

Acknowledgements

Joris Aerts

Revision History

Revision: 1.0
Date: 20 May 2026
Description: Post new finding

Path Traversal in Altium Enterprise Server Viewer Storage Controller

A path traversal vulnerability exists in the Altium Enterprise Server Viewer StorageController due to improper handling of file path route parameters.

Description

A path traversal vulnerability exists in the Altium Enterprise Server Viewer StorageController due to improper handling of file path route parameters. On on-premise deployments that use local filesystem storage, a regular authenticated user can supply a URL-encoded absolute path (such as an encoded drive letter) in a Viewer storage API request, causing the configured storage root to be discarded and allowing arbitrary files to be read from the server filesystem.

Because the readable files include the server's master configuration, which stores database credentials, signing key locations, certificate passwords, and OAuth secrets, exploitation can lead to disclosure of all server secrets and full compromise of the server and its data. Cloud deployments are not affected, as they use object storage and do not enable this component.

CVSS: 9.4

Detail of Vulnerability: CVE Record: CVE-2026-9129

Affected Products

Product: Altium Enterprise Server
Affected version: All versions prior to 8.0.4
Mitigated version: 8.0.4

Recommendations

Update to latest version

Acknowledgements

Joris Aerts

Revision History

Revision: 1.0
Date: 20 May 2026
Description: Post new finding

Stored Cross-Site Scripting in Altium Live User Profile Fields

A stored cross-site scripting (XSS) vulnerability exists in the user profile text fields of Altium 365.

Description

A stored cross-site scripting (XSS) vulnerability exists in the user profile text fields of Altium 365. Insufficient server-side input sanitization allows authenticated users to inject arbitrary HTML and JavaScript payloads using whitespace-based attribute parsing bypass techniques.

The injected payload is persisted and executed when other users view the affected profile page. Successful exploitation could allow an attacker to perform actions such as session token theft, phishing attacks, or malicious redirections in the context of the victim’s browser session.

Exploitation requires an authenticated account and user interaction to view the crafted profile but does not require elevated privileges.

CVSS: 7.6

Detail of Vulnerability: CVE Record: CVE-2026-1008

Affected Products

Product: Altium Live
Affected version: 1.2.2
Mitigated version: 1.2.3

Recommendations

Update to latest version

Acknowledgements

Joris Aerts

Revision History

Revision: 1.0
Date: 16 January 2025
Description: Post new finding

Stored Cross-Site Scripting in Altium Live Forum

A stored cross-site scripting (XSS) vulnerability exists in the Altium Forum due to missing server-side input sanitization in forum post content.

Description

A stored cross-site scripting (XSS) vulnerability exists in the Altium Forum due to missing server-side input sanitization in forum post content. An authenticated attacker can inject arbitrary JavaScript into forum posts, which is stored and executed when other users view the affected post.Successful exploitation allows the attacker’s payload to execute in the context of the victim’s authenticated Altium 365 session, enabling unauthorized access to workspace data, including design files and workspace settings. Exploitation requires user interaction to view a malicious forum post.

CVSS: 9.0

Detail of Vulnerability: CVE Record: CVE-2026-1009

Affected Products

Product: Altium Live
Affected version: 1.2.2
Mitigated version: 1.2.3

Recommendations

Update to latest version

Acknowledgements

Joris Aerts

Revision History

Revision: 1.0
Date: 16 January 2025
Description: Post new finding

Over-Permissive CORS Configuration in Altium 365 Workspace

An over-permissive Cross-Origin Resource Sharing (CORS) configuration exists in the Altium 365 workspace, allowing credentialed cross-origin access from other Altium-controlled subdomains. This misconfiguration can be abused to access authenticated workspace APIs when chained with vulnerabilities in external applications.

Description

An over-permissive Cross-Origin Resource Sharing (CORS) configuration was identified in the Altium 365 workspace web application. The workspace was configured to allow credentialed cross-origin requests from other Altium-controlled subdomains (for example, forum.live.altium.com) via the Access-Control-Allow-Origin and Access-Control-Allow-Credentials response headers.

As a result, JavaScript executing on those external origins could perform authenticated requests to Altium 365 workspace endpoints in the context of a logged-in user. When chained with vulnerabilities such as stored cross-site scripting (XSS) in those external applications, this misconfiguration could enable unauthorized access to workspace data, execution of administrative actions, and bypass of IP allowlisting controls, including in GovCloud environments.

This issue represents a trust boundary failure in the Altium 365 platform, where untrusted or less-trusted applications were permitted to interact with sensitive workspace APIs.

CVSS: 9.0

Detail of Vulnerability: CVE Record: CVE-2026-1181

Affected Products

Product: Altium 365
Affected version: All versions prior to the CORS configuration fix
Mitigated version: Configuration update applied

Recommendations

No customer action required

Acknowledgements

Joris Aerts

Revision History

Revision: 1.0
Date: 16 January 2025
Description: Post new finding

Stored Cross-Site Scripting in Altium Enterprise Server Workflow Engine

A stored cross-site scripting (XSS) vulnerability exists in the Altium Workflow Engine due to missing server-side input sanitization in workflow form submission APIs.

Description

A stored cross-site scripting (XSS) vulnerability exists in the Altium Workflow Engine due to missing server-side input sanitization in workflow form submission APIs. A regular authenticated user can inject arbitrary JavaScript into workflow data.

When an administrator views the affected workflow, the injected payload executes in the administrator’s browser context, allowing privilege escalation, including creation of new administrator accounts, session token theft, and execution of administrative actions.

CVSS: 8.0

Detail of Vulnerability: CVE Record: CVE-2026-1010

Affected Products

Product: Altium Enterprise Server
Affected version: 8.0.1
Mitigated version: TBD

Recommendations

Update to latest version

Acknowledgements

Joris Aerts

Revision History

Revision: 1.0
Date: 16 January 2025
Description: Post new finding

Stored Cross-Site Scripting in Altium Live Support Center

A stored cross-site scripting (XSS) vulnerability exists in the Altium Support Center AddComment endpoint due to missing server-side input sanitization.

Description

A stored cross-site scripting (XSS) vulnerability exists in the Altium Support Center AddComment endpoint due to missing server-side input sanitization. Although the client interface applies HTML escaping, the backend accepts and stores arbitrary HTML and JavaScript supplied via modified POST requests.The injected content is rendered verbatim when support cases are viewed by other users, including support staff with elevated privileges, allowing execution of arbitrary JavaScript in the victim’s browser context.

CVSS: 6.1

Detail of Vulnerability: CVE Record: CVE-2026-1011

Affected Products

Product: Altium Live
Affected version: 1.1.1.39
Mitigated version: 1.1.1.40

Recommendations

Update to latest version

Acknowledgements

Joris Aerts

Revision History

Revision: 1.0
Date: 16 January 2025
Description: Post new finding

Security advisories for 2024

Self signed certificate validation missing - AD

Altium 24.9.0 does not validate the self signed server certificate, including for cloud connections.

Description

Altium 24.9.0 does not validate the self signed server certificate, including for cloud connections. This allows for MITM attacks that can steal sensitive data including authentication credentials or design data.

CVSS: 5.3

Detail of Vulnerability: CVE-2025-27377

Affected Products

Product: Altium Designer, AES
Affected version: 24.9
Mitigated version: 25.2

Recommendations

Update to latest version

Acknowledgements

Joris Aerts

Revision History

Revision: 1.1
Date: 04 April 2025
Description: Add acknowledgement

XSS in BOM Viewer - AES

BOM Viewer on AES7.0.3 does not sanitize all fields.

Description

BOM Viewer on AES7.0.3 does not sanitize all fields. Script execution can be achieved by creating a schematic with a javascript payload in the Description field

CVSS: 6.8
Detail of Vulnerability: CVE-2025-27379

Affected Products

Product: AES
Affected version: 7.0.3
Mitigated version: 7.0.6

Recommendations

Update to latest version

Acknowledgements

Joris Aerts

Revision History

Revision: 1.1
Date: 04 April 2025
Description: Add acknowledgement

SQL Injection - AES

An inactive configuration allows SQL injection to occur by not activating the latest implementation of SQL parsing logic.

Description

An inactive configuration allows SQL injection to occur by not activating the latest implementation of SQL parsing logic.

CVSS: 8.6
Detail of Vulnerability: CVE-2025-27378

Affected Products

Product: AES
Affected version: 7.0.3
Mitigated version: 7.0.6

Recommendations

Update to latest version

Acknowledgements

Joris Aerts

Revision History

Revision: 1.1
Date: 04 April 2025
Description: Add acknowledgement

HTML injection - AES

Altium Enterprise Server is vulnerable to an HTML injection attack that allows the execution of arbitrary javascript.

Description

Stealing Session ID through Project Release.

CVSS: 7.6
Detail of Vulnerability: CVE-2025-27380

Affected Products

Product: AES
Affected version: 7.0.3
Mitigated version: 7.0.6

Recommendations

Update to latest version

Acknowledgements

Joris Aerts

Revision History

Revision: 1.1
Date: 04 April 2025
Description: Add acknowledgement