CVE-2026-92808

CVE-2026-92808 is a server-side request forgery vulnerability in the UnifiedLogin service of Altium Enterprise Server. An unauthenticated network attacker can trigger the server to issue HTTP requests to destinations of the attacker's choosing, including internal-only services; one such internal service exposes server configuration and stored credential material to any request that appears to originate locally, a check the forged requests satisfy. Using the harvested credentials, the attacker can obtain an administrative session and achieve full compromise of the server and all of its services. Only on-premises/self-hosted deployments are affected; the vulnerable endpoint is disabled in Altium 365 cloud mode. There is no CISA KEV listing and no known public proof-of-concept or reported exploitation to date, though the maximum CVSS 4.0 score of 10.0 reflects trivially exploitable, unauthenticated remote conditions.

What to do: Apply the vendor's patched release for Altium Enterprise Server as soon as one is available (no fixed version is stated in the current data) and keep the server off the public internet, reachable only via VPN or IP allowlisting. As interim mitigation, prevent the server process from reaching the internal configuration/credential service, add authentication or network controls around that internal endpoint, and review logs for unauthenticated requests to UnifiedLogin followed by unexpected outbound connections. If compromise is suspected, rotate all credentials stored on the server and invalidate active administrative sessions.