ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-9152

A missing authentication vulnerability exists in the Altium 365 SearchService.

Published May 21, 2026 · catalog updated Jul 23, 2026 · A missing authentication vulnerability

Check if you run it

No confirmed exploitation is on record for CVE-2026-9152. EPSS is 0.54%. Act only if a listed version of A missing authentication vulnerability is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (A missing authentication vulnerability).
  • No version range is stored. A customer cannot check an installed version against this record.
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Critical10.0
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.54%
Remediation
Advisory link
Affected products
See sources for product scope

A missing authentication vulnerability exists in the Altium 365 SearchService. A legacy SOAP endpoint exposes search index operations without requiring authentication, session tokens, or any form of identity verification. An unauthenticated network attacker who can reference a target workspace's identifier can interact with that workspace's search index, crossing tenant boundaries. Successful exploitation allows reading a workspace's indexed contents (such as component data, project and folder names, and user metadata) and injecting, modifying, or deleting search index entries. These operations affect the search index only, not the underlying vault data, but they can disclose sensitive workspace information and compromise the integrity and availability of search results. Altium 365 cloud deployments are affected; on-premise Altium Enterprise Server is not affected.

No affected version ranges are stored yet. Use the vendor advisory before you decide this record does not apply.

How to fix CVE-2026-9152

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-9152. EPSS is 0.54%. Act only if a listed version of A missing authentication vulnerability is installed.

Which versions are affected?

Affected version ranges are not on this record. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-306: Missing Authentication for Critical Function; CWE-639: Authorization Bypass Through User-Controlled Key. EPSS 0.54%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. May 21, 2026 · NIST NVD

    Detected

    A missing authentication vulnerability exists in the Altium 365 SearchService. A legacy SOAP endpoint exposes search index operations without requiring authentication, session tokens, or any form of identity verification. An unauthenticated network attacker who can reference a target workspace's identifier can interact with that workspace's search index, crossing tenant boundaries. Successful expl

  2. Jul 23, 2026 · NIST NVD

    Updated

    A missing authentication vulnerability exists in the Altium 365 SearchService. A legacy SOAP endpoint exposes search index operations without requiring authentication, session tokens, or any form of identity verification. An unauthenticated network attacker who can reference a target workspace's identifier can interact with that workspace's search index, crossing tenant boundaries. Successful expl

Sources

  • CVE.orgVulnerability recordCVE-2026-9152

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-9152

    30-day exploitation probability 0.5%

    first.org
  • NIST NVDVulnerability recordCVE-2026-9152

    A missing authentication vulnerability exists in the Altium 365 SearchService. A legacy SOAP endpoint exposes search index operations without requiring authentication, session tokens, or any form of identity verification. An unauthenticated network attacker who can reference a ta

    nvd.nist.gov

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.