CVE-2025-27378 is a high severity SQL injection (CVSS 8.6) in Altium Enterprise Server (AES) 7.0.3. An inactive configuration keeps the latest SQL parsing logic from being applied. Altium lists 7.0.6 as the mitigated version and recommends updating to the latest release.
What's affected
Altium's security advisory lists the affected product as Altium Enterprise Server (AES), version 7.0.3, with 7.0.6 as the mitigated version. The recommendation is to update to the latest version.
The advisory describes the flaw this way: an inactive configuration allows SQL injection by not activating the latest implementation of SQL parsing logic. The CVE record adds that when the configuration is not enabled, crafted input may be improperly handled, allowing arbitrary SQL queries.
The same advisory page lists neighboring issues in AES, including CVE-2025-27379 and CVE-2025-27380 (an HTML injection), all with affected version 7.0.3 and mitigated version 7.0.6. Updating to 7.0.6 or later addresses the set. Altium credits Joris Aerts in the advisory. Its revision 1.1 is dated 4 April 2025.
How to check if you're exposed
Find the version in the AES management interface or the installer's version information, and compare it with 7.0.3 and 7.0.6.
- 7.0.3: affected.
- 7.0.6 or later: the mitigated version according to Altium.
I could not confirm the status of versions between 7.0.3 and 7.0.6, so treat any version below 7.0.6 as needing an update, and check Altium's release notes. Also check who can reach the server. Enterprise Server is usually an internal service for design teams. If it is reachable from the internet, restrict it to your network or a VPN, since the SQL injection requires no login per the CVSS vector.
What to do now
- Find every Altium Enterprise Server and its version.
- Update to 7.0.6 or later, using Altium's installer and release notes, and test design data access afterward.
- Restrict the server to internal networks or a VPN.
- Review the database account used by AES and limit it to the rights it needs.
- Check logs for unusual requests to the server around the disclosure dates.
Why it matters
The record lists CWE-89, SQL Injection, and CWE-20, Improper Input Validation. The unusual detail here is the cause: a safer SQL parsing implementation existed but sat behind a configuration that was not active. Secure behavior that is off by default protects nobody, and teams that skip the setting inherit the weakness.
The score is 8.6, with a network vector, no privileges and high confidentiality impact. The record does not list the CVE in CISA's Known Exploited Vulnerabilities catalog. Enterprise Server holds electronics design data and component libraries, which are valuable intellectual property.
Quick check
What does the inactive configuration mean?
According to the advisory, a newer SQL parsing implementation was not switched on, so older handling applied. Updating to 7.0.6 fixes it.
Does the fix need extra configuration?
Altium's advisory simply recommends updating. Read the release notes for 7.0.6 for any settings to confirm.
Sources
Last reviewed: 19 October 2026.
