CVE-2026-11414 describes a critical security flaw in Altium Enterprise Server where a hard-coded cryptographic key is used universally to sign file download URLs in the Vault service. This allows unauthenticated attackers with network access to forge valid signatures and download files without credentials. A related path traversal vulnerability in the download endpoint enables attackers to escape the configured storage root directory and read arbitrary files on the server. The combination of these vulnerabilities can expose sensitive server configuration and cryptographic keys, facilitating full server compromise. The vulnerability can be chained with CVE-2026-9152 for bulk content enumeration and download. Altium 365 cloud deployments are not impacted due to their use of object storage instead of local filesystem storage.

An unauthenticated remote attacker can exploit the hard-coded cryptographic key to forge valid download URLs and retrieve files from the Vault storage without any authentication. The path traversal vulnerability further allows reading arbitrary files on the server filesystem, including sensitive configuration and key material. These combined issues can lead to full compromise of the Altium Enterprise Server. The vulnerability has a CVSS 4.0 score of 10.0, indicating critical severity. Altium 365 cloud deployments are not affected in practice.

No official patch or remediation has been confirmed or published by the vendor at this time. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the Altium Enterprise Server Vault service to trusted users only and monitor for suspicious activity. Consider isolating the server to limit exposure. Altium 365 cloud deployments are not impacted due to architectural differences.