OpenCTI CVE-2026-35211

Exploitation requires an active, authenticated OpenCTI session with the KNOWLEDGE capability explicitly assigned to the user account - this is the specific RBAC permission that grants access to the 'script' FilterOperator within the GraphQL API's FilterOperator enum. The 'script' operator must be accessible via the GraphQL API, with no indication it is disabled by default in configurations prior to the patch. External attackers must first obtain valid OpenCTI credentials bearing the KNOWLEDGE role. Unauthenticated exploitation is not possible per the CVSS PR:L metric. No non-default configuration is required beyond a standard OpenCTI deployment with an Elasticsearch backend. The key limiting factor is possession of a valid KNOWLEDGE-capable account, making this a meaningful insider threat or compromised-credential scenario rather than an opportunistic external attack.

The CVSS 3.1 base score of 6.5 (Medium) reflects a network-reachable (AV:N), low-complexity (AC:L) attack requiring only low-privilege authentication (PR:L - the KNOWLEDGE role). The C:N/I:N/A:H impact profile confirms that risk is exclusively availability-focused, with no path to data theft or integrity violation confirmed by available data. No EPSS score was provided in the input, and the vulnerability is absent from the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. The 'RCE' tag in the source intelligence is inconsistent with the CVSS C:N/I:N metrics and the CVE description's explicit framing of CPU exhaustion as the impact - defenders should not treat this as an RCE risk without independent verification. Real-world priority is highest for multi-tenant OpenCTI deployments or organizations where insider threat or compromised low-privilege credentials are concerns, since any KNOWLEDGE-capable user can trigger platform-wide DoS. The highly specialized user base of a threat intelligence platform means external attackers must first compromise valid credentials, partially offsetting the otherwise straightforward attack path.

An authenticated OpenCTI user assigned the KNOWLEDGE capability submits a GraphQL search query using the 'script' FilterOperator, embedding a Painless script containing a computationally expensive loop or heavy aggregation targeting the Elasticsearch cluster. The cluster's CPU threads are consumed by the script execution, causing query timeouts and platform-wide service degradation for all concurrent OpenCTI users. No public exploit code is confirmed at time of analysis, but the attack is straightforward to construct from knowledge of OpenCTI's GraphQL schema and Painless scripting documentation.