CVE-2025-27378

9.8 criticalEPSS 0.4%

Critical (9.8) in altium on-prem enterprise server. EPSS 0.4% chance of exploitation in the next 30 days.

AES contains a SQL injection vulnerability due to an inactive configuration that prevents the latest SQL parsing logic from being applied. When this configuration is not enabled, crafted input may be improperly handled, allowing attackers to inject and execute arbitrary SQL queries.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 32% of CVEs (scores of 2026-10-31)
CWEs: CWE-20, CWE-89
Published: 2026-01-22
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

altium:on-prem_enterprise_server

References

https://www.altium.com/platform/security-compliance/security-advisories

Check your stack JSON