CVE-2026-1009: XSS in Altium Live Forum

The impact of this XSS vulnerability is significant. An authenticated attacker can inject malicious JavaScript into forum posts, which are then stored and executed when other users view the affected post. This allows the attacker’s payload to execute in the context of the victim’s authenticated Altium 365 session. This can lead to unauthorized access to workspace data, including sensitive design files and workspace settings. The attacker could potentially steal credentials, modify designs, or perform other malicious actions within the compromised workspace. The requirement for user interaction to view the malicious post slightly mitigates the risk, but widespread forum usage increases the potential for exploitation.

1. Reserved2026-01-15
2. Published2026-01-15
3. Modified2026-01-20
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-1009 is to upgrade Altium Live Forum to version 1.2.3 or later, which includes the necessary input sanitization fixes. If upgrading immediately is not feasible, consider temporarily restricting user permissions within the forum to limit the potential impact of successful exploitation. Monitor forum activity for suspicious posts or unusual user behavior. While a direct WAF rule is difficult to implement without specific payload signatures, general XSS filtering rules can provide a baseline level of protection. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple JavaScript payload into a forum post and verifying that it is not executed.