CVE-2026-27960
Critical
Description
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. In versions 6.6.0 through 6.9.12, there is a privilege escalation vulnerability that can be exploited by unauthenticated attackers to query the API as any existing user, including the default admin account. This issue has been fixed in version 6.9.13. As a workaround, the default admin can be disabled using the `APP__ADMIN__EXTERNALLY_MANAGED` configuration.
SeverityCritical
CVSS9.8
Exploit probability—
ProductCiteum Opencti
PublishedMay 5, 2026
First seenMay 5, 2026
Weakness typeCWE-287Improper authentication
How to fix
Update
- citeum opencti6.9.13 or later
- pycti6.9.13 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| citeum opencti | 6.9.0 ≤ v < 6.9.13 | 6.9.13 |
| pyctiPyPI | 6.9.0 ≤ v < 6.9.13 | 6.9.13 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.