CVE-2026-1010: high-severity vulnerability in Altium Enterprise Server
Stored Cross-Site Scripting in Altium Enterprise Server Workflow Engine Allows Privilege Escalation
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8epss 0.3%
A stored cross-site scripting (XSS) vulnerability exists in the Altium Workflow Engine due to missing server-side input sanitization in workflow form submission APIs. A regular authenticated user can inject arbitrary JavaScript into workflow data.
When an administrator views the affected workflow, the injected payload executes in the administrator’s browser context, allowing privilege escalation, including creation of new administrator accounts, session token theft, and execution of administrative actions.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected products
Altium · Altium Enterprise ServerRelated CVEs — Altium Enterprise Server
In the same product, most dangerous first.
CVE-2026-11429CRITICALPath Traversal in Altium Vault ScriptsController Allows Unauthenticated Remote Code ExecutionEPSS 1.1%CVE-2026-14439CRITICALPath Traversal in Altium Git Service Allows Remote Code ExecutionEPSS 0.7%CVE-2026-11420CRITICALPath Traversal in Altium Enterprise Server NIS Allows Unauthenticated Arbitrary File Write and File ReadEPSS 0.7%CVE-2026-9102CRITICALPath Traversal in Altium Enterprise Server ComparisonService Allows Arbitrary File WriteEPSS 0.6%CVE-2026-92808CRITICALServer-Side Request Forgery in Altium Enterprise Server UnifiedLogin Service Allows Unauthenticated System CompromiseEPSS 0.6%CVE-2026-11419CRITICALPath Traversal in Altium Enterprise Server Vault UploadController Allows Arbitrary File WriteEPSS 0.5%