CVE-2026-11414 is a critical flaw (CVSS 9.8) in the Vault service of Altium Enterprise Server: a hard-coded signing key for download URLs, combined with a path traversal. Together they let an unauthenticated attacker read server files. Altium fixed it in 8.1.1, and Altium 365 cloud is not impacted in practice.
What's affected
From Altium's security advisory:
- Product: Altium Enterprise Server, versions before 8.1.1.
- Component: the Vault service, specifically the endpoint that serves file downloads with signed URLs.
- Fixed version: 8.1.1. Altium recommends updating to 8.1.1 or later.
- Not impacted in practice: Altium 365 cloud deployments, because file storage there uses object storage and not the local file system.
- Weakness classes: CWE-798 (use of hard-coded credentials) and CWE-22 (path traversal).
- Related issue: Altium says the flaw can be chained with CVE-2026-9152 to list and bulk download stored content.
- Severity: CVSS 9.8 in the CVE record and 10.0 in Altium's own advisory.
- Advisory date: 5 June 2026.
How to check if you're exposed
- Find every Altium Enterprise Server in your estate and read its version. Anything before 8.1.1 is affected.
- Check whether the Vault service is reachable from outside your trusted network. The advisory says the attacker only needs to reach the server over the network.
- Review Vault and web server logs for download requests that do not match normal user activity, including requests that come from unfamiliar addresses and requests for files outside the Vault storage folder.
- Make a list of the secrets stored on the server: configuration files, connection strings and keys. If the server was reachable before the update, treat those as possibly read.
What to do now
- Update Altium Enterprise Server to 8.1.1 or later. The same release covers other advisories on the Altium page with fixes in 8.1.1, so one update pass covers several findings.
- Limit network access to the server until the update is done. A VPN or an allowlist of office and partner addresses is a reasonable stopgap.
- After updating, rotate secrets that the server holds. The advisory says the exposed files can include server configuration and key material, which could allow full server compromise.
- Check for CVE-2026-9152 and the other Altium advisories on the same page, and confirm 8.1.1 covers them for your deployment.
- Review file access logs for the period before you patched, and keep them. If anything looks wrong, treat the host as compromised and follow your incident process.
Why it matters
A hard-coded cryptographic key is a key that ships inside the product, so every installation uses the same value. Signed download links are meant to prove that the server issued them. If the signing key is the same everywhere and an attacker can obtain it, the attacker can create links that the server accepts, and the signature check stops being a barrier. Altium says exactly that: the key is identical across installations, so a valid signature can be forged without authentication.
The second weakness is a separate path traversal in the same download endpoint. With it, a request can leave the configured storage root and read arbitrary files on the server file system. Combined, an attacker could read configuration and key material, which Altium says can lead to full server compromise. The record does not claim exploitation, and the CVE is not in the CISA Known Exploited Vulnerabilities catalog.
Hard-coded keys are a good reminder of why a software bill of materials and a regular dependency review do not cover everything. These flaws sit in the vendor's own code. What you control is exposure, patch speed and secret rotation, and those three are the actions above.
Quick check
Why does the advisory say 10.0 when the CVE record says 9.8?
Altium's advisory lists 10.0 under its own scoring and the CVE record lists 9.8. Both are critical, and the fix is the same.
Is Altium 365 cloud affected?
Altium says cloud deployments are not impacted in practice, because file storage there uses object storage rather than the local file system.
Is this exploited in the wild?
Neither the record nor the Altium advisory says so, and it is not in the CISA Known Exploited Vulnerabilities catalog.
Sources
- Gold entry and CVE record: CVE-2026-11414.
- Altium security advisories, Vault service entry, revision date 5 June 2026.
Last reviewed: 19 October 2026.
