CVE-2026-92808
CVE-2026-92808 is a critical-severity vulnerability with a CVSS 4.0 base score of 10.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-306.
Key facts
- Severity: Critical (CVSS 4.0 base score 10.0)
- EPSS exploit prediction: 0% (25th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-306
- Published:
- Last modified:
Description
A server-side request forgery (SSRF) vulnerability exists in the UnifiedLogin service of Altium Enterprise Server. An unauthenticated network attacker can cause the server to issue outbound HTTP requests to a destination of the attacker's choosing, including internal services that are reachable only from the server itself. One such internal service exposes server configuration and credential material without authentication, relying only on the request originating locally. Because the forged requests originate from the server process, that check is satisfied. An unauthenticated attacker can therefore retrieve stored credentials and use them to obtain an administrative session, resulting in full compromise of the server and all of its services. Altium 365 cloud deployments are not affected, as the affected endpoint is disabled in cloud mode.
Frequently asked questions
- What is CVE-2026-92808?
- A server-side request forgery (SSRF) vulnerability exists in the UnifiedLogin service of Altium Enterprise Server. An unauthenticated network attacker can cause the server to issue outbound HTTP requests to a destination of the attacker's choosing, including internal services that are reachable only from the server itself. One such internal service exposes server configuration and credential material without authentication, relying only on the request originating locally. Because the forged requests originate from the server process, that check is satisfied. An unauthenticated attacker can therefore retrieve stored credentials and use them to obtain an administrative session, resulting in full compromise of the server and all of its services. Altium 365 cloud deployments are not affected, as the affected endpoint is disabled in cloud mode.
- How severe is CVE-2026-92808?
- CVE-2026-92808 has a CVSS 4.0 base score of 10.0, rated critical severity.
- Is CVE-2026-92808 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (25th percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2026-92808?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
- When was CVE-2026-92808 published?
- CVE-2026-92808 was published on 2026-09-16 and last updated on 2026-09-18.
References
Other CWE-306 (Missing Authentication for Critical Function) vulnerabilities
- CVE-2026-85889 — Critical (CVSS 10.0): Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges…
- CVE-2026-59971 — Critical (CVSS 10.0): MySQL MCP Server is a Model Context Protocol server that enables secure interaction with MySQL databases. Prior to…
- CVE-2026-80462 — Critical (CVSS 10.0): A vulnerability in the Chef Automate API gateway and identity validation path may allow an unauthenticated actor to…
- CVE-2026-75754 — Critical (CVSS 10.0): Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF), and Use of Hard-coded Credentials in…
- CVE-2026-70352 — Critical (CVSS 10.0): Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to elevate privileges…
- CVE-2026-81735 — Critical (CVSS 10.0): startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen address to '::' when no host was…
Browse all CWE-306 (Missing Authentication for Critical Function) vulnerabilities →