KB: Vulnerability Findings for Unsupported Microsoft Components on Altium Enterprise Server
Altium On-Prem Enterprise Server
Solution Details
Security Scans May Flag Unused Components
A security or vulnerability scan may report an unsupported Microsoft component on the server where AES is installed. Depending on the scanner and the component's Microsoft support status, the finding may be assigned a high or critical severity.
The finding confirms that the component is present, but does not by itself establish that AES installed or currently uses it.
Legacy Components Can Remain After Upgrades
Microsoft runtimes, frameworks, and other shared components can remain installed on Windows after applications are upgraded or reconfigured. They may originate from an earlier installation, testing, or other software on the same system.
When these components reach end of support, vulnerability scanners may continue to report them based on their presence, even if they are no longer used by AES.
Verify Dependencies Before Removing Components
Determine whether the reported component is required before taking corrective action. Microsoft runtime requirements can differ between AES releases, so the presence of a newer Microsoft component does not necessarily mean that an older one can be safely removed.
- Review the system requirements for your installed AES version.
- Confirm whether AES requires the reported component.
- Verify whether another application or service on the server depends on it.
- If the component is not required, coordinate its removal with your IT or system administrator.
Validate and Remove Unneeded Components Safely
- Identify the installed AES version and the exact Microsoft component and version reported by the vulnerability scanner.
- Review the applicable AES system requirements and confirm that all required Microsoft components are installed.
- Verify that neither AES nor another application or service requires the flagged component.
- Before changing a production system, ensure that an appropriate current backup is available. Where practical, validate the change in a non-production environment first.
- If the component is confirmed as unnecessary, have the appropriate system administrator uninstall it using standard Windows management tools and your organization's change-management procedures.
- Verify that AE starts normally and that its required services and functionality remain available.
- Rerun the vulnerability scan, or request a rescan from your security team, to confirm that the finding is resolved.
Additional Notes
Example: Legacy .NET Runtimes
Older .NET runtimes may remain installed following an application upgrade and can later be reported as unsupported. Do not assume that installing a newer .NET runtime makes an older runtime unnecessary. Verify the requirements of your AE version and any other applications before removing it.
Example: Microsoft Silverlight
Microsoft Silverlight is another example of a component that may remain installed even when it is no longer required by an active application. If a scan detects Silverlight, confirm that AESand other software on the system do not require it before removal.
Important Considerations
- This article complements, but does not replace, the official system requirements for your installed AE version.
- Do not assume that a Microsoft component belongs to AE solely because it is installed on the same system.
- Do not remove Microsoft runtimes or frameworks until application and system dependencies have been verified.
- Follow your organization's backup and change-management procedures when modifying a production system.
Frequently Asked Questions
Is the unsupported Microsoft component installed by AES?
Not necessarily. It may have been installed by an earlier application, another product, or during previous testing. Its presence on the server does not establish that AES installed or uses it.
Does the finding mean my AES installation is unsupported?
Not necessarily. Compare your AES version, operating system, and required dependencies with the applicable Altium system requirements. An unrelated unsupported component may exist on the same server without being an AES dependency.
Can I uninstall the component reported by the scanner?
Yes, if you have confirmed that AES and other applications or services on the system do not require it. In a managed environment, coordinate the change with your IT or system administrator.
Why did an AES upgrade leave the old component installed?
Microsoft runtimes, frameworks, and other shared components are managed at the operating-system level and may be used by multiple applications. An AES upgrade therefore does not necessarily remove them.
Where can I check the Microsoft components required by AES?
Review the official Altium system requirements documentation applicable to your installed AES version.