Quick answers
- Is CVE-2026-11424 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-11424 being exploited in the wild.
- How severe is CVE-2026-11424?
- Informational severity, with a CVSS score of 8.3, published 5 June 2026.
- Which products and versions are affected?
- Altium 365 All cloud instances prior to June 2026 remediation.
- Is there a fix for CVE-2026-11424?
- A patch was published on 2026-06-05: Remediated in Altium 365 and fixed in Enterprise Server 8.1.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-11424 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-11424?
- Check whether you run Altium 365 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A server-side request forgery (SSRF) vulnerability exists in a shared GraphQL service component. The root cause is a lack of URL validation and destination filtering when the server processes user-supplied input as a URL for outbound HTTP GET requests. An authenticated attacker can exploit this to reach internal network services and cloud metadata endpoints (IMDS) that are not publicly accessible. The exploit is limited to HTTP GET requests without custom headers, but the server returns the full response body to the attacker. Altium 365 has been patched at the service level, while on-premise Enterprise Server users must update to version 8.1.1.
Affected products
- Altium Enterprise Server versions prior to 8.1.1
- Altium 365 All cloud instances prior to June 2026 remediation
Timeline
- 2026-06-05: disclosed
- 2026-06-05: advisory
- 2026-06-05: patched: Remediated in Altium 365 and fixed in Enterprise Server 8.1.1