OpenCTI CVE-2026-35212

Exploitation requires two distinct conditions: first, the attacker must be able to introduce STIX data containing a malicious email-message observable body into the platform, achievable via an external STIX sharing partnership, a configured ingester, or any feed the platform trusts - no platform authentication is required for this step (CVSS PR:N confirmed). Second, an authenticated OpenCTI user must view (passively interact with, UI:P) the rendered observable in the platform UI. Exploitation is limited by this mandatory user-interaction step - automated mass exploitation is not possible. Additionally, the platform must have email-message observable ingestion active and the affected observable must be routed to a user's view; deployments that do not ingest email-message objects are not exposed to this specific attack path. Session theft impact is further limited to users whose browsers render the malicious observable before the patch is applied.

The CVSS 4.0 base score of 5.3 (Medium) reflects a nuanced picture: while the attack vector is network-accessible and requires no authentication to inject (PR:N), actual exploit impact is scoped to subsequent system effects (SC:L/SI:L) and requires user interaction (UI:P), preventing fully automated exploitation. EPSS data is not provided in the source intelligence, so exploitation probability cannot be quantified. KEV status is negative and no POC has been identified, meaning no confirmed in-the-wild exploitation at time of analysis. However, the downstream CSRF-to-session-theft chain described by the vendor elevates real-world risk beyond what the raw CVSS score suggests - a single victim interaction could expose multiple user sessions if CSRF payloads target authentication tokens or API keys stored client-side. The ingester and STIX-sharing attack surface means the injection point is accessible to any external threat feed contributor, not just platform users, broadening the realistic attacker pool. Priority should be elevated for deployments with active external STIX feeds or open ingester integrations.

An attacker with access to an external STIX sharing feed or ingester integration submits a crafted email-message STIX object containing a JavaScript payload in the body field - no platform account is required. When an authenticated OpenCTI analyst navigates to view the observable, the unsanitized body renders the script in their browser session, which then silently issues CSRF requests to exfiltrate session tokens or perform privileged actions on behalf of the victim. No public exploit code has been confirmed at time of analysis, but the attack is low-complexity and consistent with well-understood stored-XSS exploitation patterns.