PT-2026-3896 · Altium · Altium Enterprise Server

Published 2026-01-22 · Updated 2026-02-26 · CVE-2025-27380

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Altium Enterprise Server (AES) version 7.0.3

Description An authenticated attacker can execute arbitrary JavaScript in a victim’s browser through crafted HTML content within the Project Release feature. This impacts all platforms.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-27380

Affected Products

Altium Enterprise Server

References · 10

• https://osv.dev/vulnerability/CVE-2025-27380 · Vendor Advisory
• https://altium.com/platform/security-compliance/security-advisories · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27380 · Security Note
• https://twitter.com/CVEnew/status/2014153666085961767 · Twitter Post
• https://twitter.com/cracbot/status/2016103968641028206 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2014274217148109067 · Twitter Post
• https://t.me/cveNotify/149507 · Telegram Post
• https://t.me/CVEtracker/42725 · Telegram Post
• https://t.me/cveNotify/153372 · Telegram Post
• https://twitter.com/lsof/status/2014399001391505432 · Twitter Post