PT-2026-3437 · Altium · Altium 365+1

Joris Aerts · Published 2026-01-19 · Updated 2026-01-24 · CVE-2026-1181

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Altium Forum (affected versions not specified)

Description A stored cross-site scripting (XSS) issue exists in the Altium Forum because of insufficient server-side input sanitization of forum post content. An authenticated attacker can inject arbitrary JavaScript into forum posts. This injected script is stored and executed when other users view the affected post. Successful exploitation allows the attacker’s payload to execute within the context of the victim’s authenticated Altium 365 session, potentially enabling unauthorized access to workspace data, including design files and workspace settings. Exploitation requires a user to view a malicious forum post.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Improper Access Control

Weakness Enumeration

CWE-942

CWE-79

CWE-284

Related Identifiers

CVE-2026-1181

Affected Products

Altium 365

Altium Forum

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-1181 · Security Note
• https://altium.com/platform/security-compliance/security-advisories · Note
• https://twitter.com/CVEnew/status/2013229526050898185 · Twitter Post
• https://twitter.com/CveFindCom/status/2013244820395905532 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2013250056384602464 · Twitter Post
• https://twitter.com/TheHackerWire/status/2013243375827251378 · Twitter Post
• https://t.me/cveNotify/149490 · Telegram Post
• https://twitter.com/0dayPublishing/status/2013226469858726201 · Twitter Post
• https://twitter.com/cracbot/status/2015016792767578533 · Twitter Post