OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. May 5, 2026 · NIST NVD

   Detected

   OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. In versions 6.6.0 through 6.9.12, there is a privilege escalation vulnerability that can be exploited by unauthenticated attackers to query the API as any existing user, including the default admin account. This issue has been fixed in version 6.9.13. As a workaround, the default admin can be disab

2. Jul 25, 2026 · NIST NVD

   Updated

   OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. In versions 6.6.0 through 6.9.12, there is a privilege escalation vulnerability that can be exploited by unauthenticated attackers to query the API as any existing user, including the default admin account. This issue has been fixed in version 6.9.13. As a workaround, the default admin can be disab

Affected

• cpe citeum/openctiversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-27960

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-27960

  OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. In versions 6.6.0 through 6.9.12, there is a privilege escalation vulnerability that can be exploited by unauthenticated attackers to query the API as any existing user, including

  nvd.nist.gov

References

• Mitigation · github.com