Altium Enterprise Server uses a hard‑coded cryptographic key to sign file download URLs for its Vault service, a key that is identical across all installations. This allows an unauthenticated network attacker with reach to the server to forge valid download signatures and retrieve files from the Vault storage without authentication, session, or credential requirements. A separate path‑traversal flaw in the same endpoint permits the configured storage root to be escaped, enabling reads of arbitrary files on the server file system. The combination of these flaws allows the attacker to obtain sensitive configuration data, key material, and additional files, potentially leading to a full compromise of the affected server. The vulnerability can be chained with CVE-2026-9152 to enumerate and bulk‑download all stored content.

Altium Enterprise Server is affected. The flaw exists in all installations regardless of version, as the cryptographic key is hard‑coded and the path‑traversal logic is unchanged. Altium 365 cloud deployments are not impacted because they use object storage rather than the local file system.

The CVSS score of 10 indicates maximum severity. EPSS data is not available, but the vulnerability can be exploited by any unauthenticated network attacker who can reach the Vault service. The flaw is not listed in the CISA KEV catalog. The likely attack vector is via unauthenticated HTTP requests to the Vault download endpoint, where an attacker forges a signature and optionally includes a traversal path to read arbitrary files. The danger is amplified by the ability to combine the flaw with CVE-2026-9152 for broader data exfiltration.