CVE-2026-11420

An unauthenticated remote attacker (CWE-306) can send requests to the NIS service, exploiting improper path validation (CWE-22 — path traversal) to write arbitrary files to selected locations in the server's file system. Since it is possible to write to directories accessible by the web server or overwrite application binary files and configuration files, an attacker can escalate access to full RCE in the context of the service account. A second vulnerability enables reading deployment package archives stored on the server, which may lead to disclosure of sensitive data.

An attacker can gain full control of the server through RCE in the context of the service account, overwrite application or configuration files, and read the contents of deployment package archives.

Apply patches available from the vendor according to references published at https://www.altium.com/platform/security-compliance/security-advisories. Until patches are applied, it is recommended to restrict network access to the NIS service only to trusted hosts using firewall or network segmentation.

Altium Enterprise Server with Network Installation Service (NIS) enabled — on-premises deployments. Altium 365 cloud deployments are not vulnerable because the NIS service is not part of the cloud offering. Specific versions are indicated in vendor references.