CVE-2026-11414: Unauthenticated File Exfiltration in Altium Enterprise Server Vault Service via Hard-coded Cryptographic Key and Path Traversal

Synopsis

An unauthenticated file exfiltration vulnerability affects Altium Enterprise Server's Vault service, combining a hard-coded cryptographic key with a path traversal flaw in the file download endpoint. The vulnerability is reachable over the network with no authentication required, as confirmed by the CVSS 4.0 vector (AV:N, PR:N, UI:N). A remote attacker can forge valid download signatures to retrieve arbitrary files from the server filesystem, including sensitive configuration and key material, leading to full server compromise. A patched-image rebuild at version 8.1.1 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the Vault service endpoint over the network; no prior foothold on the host is needed.

• AuthenticationNot required

  No credentials, session token, or account of any privilege level are required to exploit this vulnerability.

• Victim interactionNot required

  The attack is fully server-side; no user action or social engineering is needed to trigger the vulnerability.

• Attack complexityDetail

  The exploit is reliable and condition-free; the hard-coded key is identical across all installations, so forging a valid signature requires no race condition or environmental tuning.

Blast Radius

• Reads arbitrary files from the server filesystem by escaping the configured Vault storage root via path traversal, including private keys, configuration files, and stored credentials.
• Retrieves all design files and intellectual property stored in the Vault, which can be bulk-downloaded when chained with CVE-2026-9152 for content enumeration.
• Obtains server key material and configuration secrets that enable follow-on attacks leading to full server compromise.
• Causes high-integrity and high-availability impact at both the system and downstream scope levels, meaning an attacker can tamper with or destroy stored data and disrupt service operation.