CVE-2026-27960

Critical

Published: 05 May 2026

Published

05 May 2026

Modified

07 May 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0006 17.1th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-27960 is a critical-severity Improper Authentication (CWE-287) vulnerability. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-2 (Account Management).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 3 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-3 Access Enforcement good match

prevent

Enforces approved authorizations to prevent unauthenticated attackers from impersonating users and accessing sensitive API data in OpenCTI.

AC-14 Permitted Actions Without Identification or Authentication good match

prevent

Defines and restricts actions permissible without identification or authentication, blocking unauthenticated API queries as any user including admin.

AC-2 Account Management good match

prevent

Manages accounts to disable default admin and unnecessary users, directly implementing the CVE workaround and limiting escalation targets.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

T1078 Valid Accounts Stealth

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

attack.mitre.org →

T1078.001 Default Accounts Stealth

Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

attack.mitre.org →

Why these techniques?

CVE describes remote unauthenticated auth bypass (CWE-287) on public-facing OpenCTI API allowing impersonation of any user including default admin; directly enables T1190 (exploit public app for initial access), T1068 (exploit for priv esc), and T1078/T1078.001 (abuse valid/default accounts without credentials).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. In versions 6.6.0 through 6.9.12, there is a privilege escalation vulnerability that can be exploited by unauthenticated attackers to query the API as any existing user,…

including the default admin account. This issue has been fixed in version 6.9.13. As a workaround, the default admin can be disabled using the `APP__ADMIN__EXTERNALLY_MANAGED` configuration.

Deeper analysisAI

CVE-2026-27960 is a privilege escalation vulnerability (CWE-287) in OpenCTI, an open-source platform for managing cyber threat intelligence knowledge and observables. The flaw affects versions 6.6.0 through 6.9.12 and enables unauthenticated attackers to query the API as any existing user, including the default admin account. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its network accessibility, low attack complexity, and lack of prerequisites.

Unauthenticated attackers can exploit this vulnerability remotely without privileges or user interaction. By leveraging the flaw, they can impersonate legitimate users to access sensitive threat intelligence data and observables, potentially leading to unauthorized data exfiltration, manipulation, or disruption of platform availability.

The vulnerability is fixed in OpenCTI version 6.9.13. As a workaround, administrators can disable the default admin account using the `APP__ADMIN__EXTERNALLY_MANAGED` configuration option. Additional details are available in the security advisory at https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-6vvv-vmfr-xhrx.