Critical severity · published May 5, 2026
CVE-2026-27960
OpenCTI privilege escalation and unauthenticated access via default admin account
9.8
CVSS
7.1%
EPSS
No
On KEV
Description
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. In versions 6.6.0 through 6.9.12, there is a privilege escalation vulnerability that can be exploited by unauthenticated attackers to query the API as any existing user, including the default admin account. This issue has been fixed in version 6.9.13. As a workaround, the default admin can be disabled using the `APP__ADMIN__EXTERNALLY_MANAGED` configuration.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)7.1% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
opencti · OpenCTI-Platform
>= 6.6.0, < 6.9.13 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-27960
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-27960
Mitigation
https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-6vvv-vmfr-xhrx
More from opencti
9.1
CVE-2025-61781
GraphQL IDOR allows authenticated user to delete workspace content of other users
9.1
CVE-2025-24977
OpenCTI has remote code execution and sensitive secrets exposed through web hook
8.2
CVE-2024-37155
OpenCTI May Bypass Introspection Restriction
8.1
CVE-2026-21886
OpenCTI's GraphQL Mutations Allow Deletion of Unrelated Entities
8.1
CVE-2024-45404
OpenCTI's lack of Rate Limit lead to OTP brute forcing