Is CVE-2026-9102 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9102 being exploited in the wild.

How severe is CVE-2026-9102?

Informational severity, with a CVSS score of 9.4, published 20 May 2026.

Which products and versions are affected?

Altium Enterprise Server ComparisonService component.

Is there a fix for CVE-2026-9102?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-9102 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-9102?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9102: Altium Enterprise Server path traversal in ComparisonService

CVE-2026-9102 · Severity: info · CVSS 9.4 · Published 2026-05-20

Altium Enterprise Server, a platform used for managing electronic design data, contains a security flaw in its file comparison service. An authenticated user can upload a specially crafted file that bypasses security restrictions to write data anywhere on the server's filesystem. This could allow an attacker to take full control of the server, steal sensitive design data, or disrupt business operations.

Quick answers

Is CVE-2026-9102 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9102 being exploited in the wild.
How severe is CVE-2026-9102?: Informational severity, with a CVSS score of 9.4, published 20 May 2026.
Which products and versions are affected?: Altium Enterprise Server ComparisonService component.
Is there a fix for CVE-2026-9102?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-9102 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-9102?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability exists in the Altium Enterprise Server ComparisonService due to missing filename sanitization in the Gerber file upload APIs. An authenticated workspace user can provide a manipulated filename in the multipart Content-Disposition header to escape the intended temporary directory. By writing files to web-accessible directories or overwriting application binaries/configuration files, an attacker can achieve remote code execution (RCE) in the context of the service account or cause a denial of service. The vulnerability is tracked as CVE-2026-9102 and has been assigned a CVSS 4.0 score of 9.4.

Affected products

Altium Enterprise Server ComparisonService component

Timeline

2026-05-20: disclosed: CVE record published and added to NVD dataset

References

https://www.altium.com/platform/security-compliance/security-advisories

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.