CVE-2026-39980criticalCWE-1336

CVE-2026-39980: critical vulnerability in OpenCTI-Platform opencti

OpenCTI affected by RCE via notifier template

Published

Follow this CVE+ Monitor opencti+ Monitor pycti

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

43Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 9.1epss 1.4%
from disclosure to weapon25 days
Published on NVDApr 9
metasploit+25d
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.9.5, the safeEjs.ts file does not properly sanitize EJS templates. Users with the Manage customization capability can run arbitrary JavaScript in the context of the OpenCTI platform process during notifier template execution. This vulnerability is fixed in 6.9.5.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected products
OpenCTI-Platform · opencti
Related CVEs — OpenCTI-Platform opencti

In the same product, most dangerous first.

CVE-2026-27960CRITICALOpenCTI privilege escalation and unauthenticated access via default admin accountEPSS 7.1%CVE-2025-24977CRITICALOpenCTI has remote code execution and sensitive secrets exposed through web hookEPSS 0.9%CVE-2024-45404HIGHOpenCTI's lack of Rate Limit lead to OTP brute forcingEPSS 0.6%CVE-2026-35211MEDIUMOpenCTI: Elasticsearch Painless Script Injection via GraphQL `script` filter operator allows authenticated user to exfiltrate data and cause DoSEPSS 0.5%CVE-2026-76821HIGHOpenCTI: User-Controlled ReDoS in JSON Ingestion MapperEPSS 0.5%CVE-2024-37155MEDIUMOpenCTI May Bypass Introspection RestrictionEPSS 0.5%