CVE-2026-11420 is a critical path traversal (CVSS 9.8) in the Network Installation Service of Altium Enterprise Server. An unauthenticated network attacker could write files anywhere the service can write, and read package archives. Altium fixed it in version 8.1.1, and Altium 365 cloud is not affected.
What's affected
From Altium's security advisory:
- Product: Altium Enterprise Server, any version before 8.1.1. The on premises edition only.
- Fixed version: 8.1.1. Altium describes it as the mitigated version and recommends updating to 8.1.1 or later.
- Not affected: Altium 365 cloud deployments, because the Network Installation Service (NIS) is not part of the cloud offering.
- Weakness classes: CWE-22 (path traversal) and CWE-306 (missing authentication for a critical function).
- Severity: CVSS 9.8 in the CVE record, and 9.4 in Altium's own advisory.
- Advisory date: 5 June 2026.
How to check if you're exposed
- Find every Altium Enterprise Server you run and read its version in the server administration interface or your deployment records. Anything before 8.1.1 needs the update.
- Confirm whether the Network Installation Service is running and whether its endpoint is reachable from outside your trusted network.
- Check whether the server sits on the internet. A design server that holds product data should not be broadly reachable, but many are published for remote teams.
- Review the server file system and service logs for unexpected recent files in web accessible folders, and for changes to application binaries or configuration files. The advisory names those as the ways this flaw can reach code execution.
What to do now
- Update Altium Enterprise Server to 8.1.1 or later. The same release covers several other advisories on the Altium page that list versions before 8.1.1.
- Until you can update, restrict network access to the server to a VPN or a short allowlist, and block the Network Installation Service from untrusted networks.
- Check the server for unexpected files and modified binaries or configuration, as described above. If you find any, treat the host as compromised and follow your incident process.
- After updating, check the version again and confirm the service account has only the file system rights it needs.
- Subscribe to the Altium security advisory page so later findings reach you.
Why it matters
Path traversal means a file path supplied by a caller is not checked, so the caller can step out of the folder the service meant to use. Here Altium says two traversal issues exist in the Network Installation Service. One lets a caller write files to any writable location. The other lets a caller read package archive files. The advisory states that no authentication, session or credentials are needed.
Arbitrary file write is serious because the written file does not need to be a script to be useful. Altium says content controlled files can land in web accessible directories or overwrite application binaries and configuration files, which can lead to remote code execution as the service account. The CVSS vector reflects that with High impact on confidentiality, integrity and availability. It is not in the CISA Known Exploited Vulnerabilities catalog, and the advisory does not say it is exploited.
Quick check
Does this affect Altium 365?
Altium says cloud deployments are not affected, because the Network Installation Service is not part of the cloud offering.
Why are there two scores, 9.8 and 9.4?
The CVE record shows 9.8. Altium's advisory lists 9.4 under its own scoring. Both are critical, and the fix is the same: update to 8.1.1 or later.
Sources
- Gold entry and CVE record: CVE-2026-11420.
- Altium security advisories, entry for the Network Installation Service, revision date 5 June 2026.
Last reviewed: 19 October 2026.
