OpenCTI CVE-2026-39980

Requires authenticated access with High privileges (PR:H) specifically holding the 'Manage customization' capability in OpenCTI. This permission allows creation and modification of notifier templates, which are processed by the vulnerable safeEjs.ts module. Default OpenCTI deployments typically restrict customization capabilities to administrator roles, not standard analysts or connectors. Exploitation is NOT possible by unauthenticated attackers, low-privilege users, or API clients without this specific capability. Attack complexity is Low (AC:L) once the privilege prerequisite is met-no special timing, race conditions, or environmental factors required beyond the capability permission. Organizations that have delegated customization rights to non-administrator roles face significantly higher realistic risk than those maintaining strict admin-only customization controls.

Despite the CVSS 9.1 Critical score, real-world risk is constrained by strict prerequisite conditions. CVSS vector indicates Network attack vector (AV:N) but requires High privileges (PR:H) with the specific 'Manage customization' capability-a sensitive permission typically restricted to platform administrators. Changed scope (S:C) correctly reflects that code execution escapes the template context into the platform process. EPSS score of 0.07% (22nd percentile) suggests minimal observed exploitation attempts, consistent with the high privilege barrier. SSVC framework assessment (Exploitation: none, Automatable: no, Technical Impact: total) aligns with EPSS, confirming this is not a mass-exploitation threat. No CISA KEV listing and GHSA advisory from GitHub indicate responsible disclosure. Primary risk scenario is insider threat or compromised admin accounts in multi-tenant deployments where lower-trust users might gain customization rights. Organizations granting customization capability to non-administrators face elevated risk. The low EPSS despite high CVSS demonstrates this is a 'configuration-dependent high impact' vulnerability rather than an internet-wide emergency.

An attacker compromises an OpenCTI administrator account with 'Manage customization' privileges through phishing or credential theft. They navigate to the notification settings and create a malicious notifier template containing embedded JavaScript payloads disguised as legitimate EJS template code. When the platform processes this template during notification generation, the unsafe safeEjs.ts module executes the injected code within the Node.js process context, granting the attacker ability to read sensitive threat intelligence data, modify platform configurations, exfiltrate database credentials, or establish persistent backdoor access to the OpenCTI server. No public proof-of-concept code exists, but SSTI exploitation techniques are well-documented for EJS template engines.