CVE-2026-39980

CriticalPublished

OpenCTI affected by RCE via notifier template

Published: Apr 9, 2026
Updated: Apr 9, 2026
Assigning CNA: GitHub_M

Primary CVSS

9.1/ 10Critical

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS probability estimate

0.7%

Low · next 30 days

Percentile: 51.7%
Model date: Oct 13, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.9.5, the safeEjs.ts file does not properly sanitize EJS templates. Users with the Manage customization capability can run arbitrary JavaScript in the context of the OpenCTI platform process during notifier template execution. This vulnerability is fixed in 6.9.5.

Sources

Repository evidence: Files: 1 · Repositories: 1

1 Module

OpenCTI Authentication Bypass and Notifier EJS Remote Code ExecutionModule
modules/exploits/linux/http/opencti_notifier_rce.rb
Metasploit Framework modules
ExploitEvidence observed: Oct 14, 2026Revision: be32cd78a532Related tool
Declared conditions
- platform: Unix($.exploit_linux/http/opencti_notifier_rce.platform)
- verification: check_declared($.exploit_linux/http/opencti_notifier_rce.check)

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.