The vulnerability resides in the Network Installation Service of Altium Enterprise Server and allows an unauthenticated attacker to write arbitrary files to any writable location on the server and to read package archive files. This path traversal flaw can produce files in web‑accessible directories, overwrite application binaries or configuration files, and ultimately lead to remote code execution in the context of the service account. The increase from file write and read to executable execution is explicitly noted in the advisory, so the potential impact spans confidentiality, integrity, and availability of the entire server.

Altium Enterprise Server has been identified as the affected product. No version information is supplied, so any installation of Altium Enterprise Server that includes the Network Installation Service is potentially impacted.

The CVSS score of 10 indicates a high risk rating and the vulnerability is exploitable without authentication, session credentials, or remote code execution prerequisites beyond network access. The EPSS score is not available, but the lack of authentication means a network attacker can attempt exploitation with low effort. The vulnerability is not listed in CISA KEV, but the severity and possible RCE path make it a high priority for immediate remediation.