Vulnerability · Published Apr 9, 2026 · Assigned by GitHub_M

CVE-2026-39980OpenCTI affected by RCE via notifier template

Critical 9.1

In plain English

A critical-severity security flaw in opencti from OpenCTI-Platform. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)1.4%top 27.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Metasploit

Official description

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.9.5, the safeEjs.ts file does not properly sanitize EJS templates. Users with the Manage customization capability can run arbitrary JavaScript in the context of the OpenCTI platform process during notifier template execution. This vulnerability is fixed in 6.9.5.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	pycti	6.9.5	PYSEC-2026-2265

Affected products (as reported)

Vendor	Product	Versions
OpenCTI-Platform	opencti	< 6.9.5

Weakness: CWE-1336 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-jv9r-jw2f-rhrf x_refsource_CONFIRM
https://github.com/OpenCTI-Platform/opencti/releases/tag/6.9.5 x_refsource_MISC