A critical SSRF vulnerability in Altium Enterprise Server allows unauthenticated attackers to achieve full system compromise by leveraging internal service trust.

The vulnerability is a Server-Side Request Forgery (SSRF) flaw in the UnifiedLogin service, which lacks proper validation for outbound requests. This allows an unauthenticated attacker to reach internal-only endpoints, bypass authentication checks that rely on local request origin, and extract sensitive configuration or credential material.

The exploitation of this vulnerability leads to a total compromise of the affected Altium Enterprise Server, granting an attacker administrative access to all hosted services. Given the CVSS score of 10.0, this represents a critical risk to data confidentiality, integrity, and availability. Unauthorized access to server credentials poses a significant threat to the broader enterprise network if those credentials are reused across other internal systems.

Immediate Action: Update Altium Enterprise Server to version 8.1.1 or later immediately to resolve the SSRF flaw.

Proactive Monitoring: Inspect server access logs for unusual outbound traffic patterns originating from the UnifiedLogin service and monitor for unauthorized attempts to access internal configuration endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict egress filtering rules to prevent the server from initiating unauthorized network requests to internal resources until the patch is applied.

Public Exploit Available: Unknown.

Due to the critical severity of this vulnerability and the potential for full administrative takeover, organizations must prioritize patching to version 8.1.1. If immediate patching is not possible, ensure the server is isolated from sensitive internal network segments to limit the scope of potential SSRF-based attacks.