OpenCTI CVE-2026-27960

No special conditions - remote unauthenticated exploitation against default configurations of OpenCTI versions 6.6.0 through 6.9.12. The CVSS vector PR:N confirms no authentication required, and AC:L indicates no special complexity or timing requirements. Attackers need only network connectivity to the OpenCTI API endpoint, typically exposed on standard HTTPS ports for operational use by security teams. The vulnerability affects all deployment modes including cloud-hosted and on-premises instances. User interaction (UI:N) is not required. The only limiting factor is network reachability to the API, meaning internet-facing instances are at highest immediate risk while internal deployments require the attacker to first gain network access to the hosting environment.

This represents critical real-world risk despite absence of confirmed active exploitation. The CVSS vector AV:N/AC:L/PR:N/UI:N indicates remote unauthenticated exploitation against default configurations with no user interaction or special complexity, maximizing exploitability. Impact scores of C:H/I:H/A:H reflect complete compromise of confidentiality, integrity, and availability of threat intelligence data. For organizations using OpenCTI to coordinate security operations, this enables attackers to read sensitive threat research, modify indicators of compromise to hide their activities, or destroy intelligence databases. The authentication bypass combined with privilege escalation to admin creates a complete platform takeover scenario. While no public exploit code is confirmed and the vulnerability is not in CISA KEV, the technical simplicity (AC:L, PR:N) means exploitation development is straightforward for competent attackers. SSVC assessment suggests immediate action given the technical impact (total system compromise) and the automatable nature of API exploitation. Organizations running affected versions should treat this as emergency-priority patching regardless of threat intelligence about active exploitation.

An external attacker sends crafted GraphQL API requests to an internet-facing OpenCTI instance, exploiting the authentication bypass to query the API while impersonating the default admin account without providing any credentials. The attacker retrieves the complete threat intelligence database including sensitive indicators, adversary profiles, and ongoing investigations, then modifies IOCs to exclude their own infrastructure from detection rules. If public exploit code becomes available, automated scanning and exploitation against exposed OpenCTI instances becomes trivial given the low attack complexity and lack of authentication requirements.