CVE-2026-27960

Critical

Published: 05 May 2026

Published

05 May 2026

Modified

12 May 2026

KEV Added

—

Patch

—

CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0048 37.9th percentile

Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-27960 is a critical-severity Improper Authentication (CWE-287) vulnerability in Citeum Opencti. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 37.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-2 (Account Management).

Deeper analysis

CVE-2026-27960 is a privilege escalation vulnerability (CWE-287) in OpenCTI, an open-source platform for managing cyber threat intelligence knowledge and observables. The flaw affects versions 6.6.0 through 6.9.12 and enables unauthenticated attackers to query the API as any existing user, including the default admin account. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its network accessibility, low attack complexity, and lack of prerequisites.

Unauthenticated attackers can exploit this vulnerability remotely without privileges or user interaction. By leveraging the flaw, they can impersonate legitimate users to access sensitive threat intelligence data and observables, potentially leading to unauthorized data exfiltration, manipulation, or disruption of platform availability.

The vulnerability is fixed in OpenCTI version 6.9.13. As a workaround, administrators can disable the default admin account using the `APP__ADMIN__EXTERNALLY_MANAGED` configuration option. Additional details are available in the security advisory at https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-6vvv-vmfr-xhrx.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-27420

Vulnerability details

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. In versions 6.6.0 through 6.9.12, there is a privilege escalation vulnerability that can be exploited by unauthenticated attackers to query the API as any existing user,…

including the default admin account. This issue has been fixed in version 6.9.13. As a workaround, the default admin can be disabled using the `APP__ADMIN__EXTERNALLY_MANAGED` configuration.

CWE(s): CWE-287

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

T1078 Valid Accounts Stealth

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

attack.mitre.org →

T1078.001 Default Accounts Stealth

Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

attack.mitre.org →

Why these techniques?

CVE describes remote unauthenticated auth bypass (CWE-287) on public-facing OpenCTI API allowing impersonation of any user including default admin; directly enables T1190 (exploit public app for initial access), T1068 (exploit for priv esc), and T1078/T1078.001 (abuse valid/default accounts without credentials).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0