CTI-Transmute EUVD-2026-52255

The /activity_timeline endpoint must be network-reachable from the attacker - confirmed as the default exposure of the CTI-Transmute web interface. No authentication is required, as the endpoint is explicitly described as unauthenticated and the CVSS 4.0 vector confirms PR:N. No special configuration, feature flag, or deployment mode is required; the vulnerability exists in the default application behavior. Exploitation is limited by: network reachability to the web interface (deployments restricted to internal networks or VPNs reduce exposure significantly), and the absence of upstream rate limiting, WAF rules, or reverse proxy authentication that would throttle or block unauthenticated large-parameter requests. There is no required user interaction and no platform-specific constraint.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) confirms that this endpoint is reachable over the network by any unauthenticated user with no preconditions, making automated or scripted abuse straightforward. The high availability impact (VA:H) is consistent with the described potential for internal server errors and service degradation under repeated large-parameter requests. However, there is no CISA KEV listing, no confirmed public PoC, and no EPSS data provided, all of which moderate the urgency compared to actively weaponized issues. The exploit maturity supplemental metric (E:X) is unset, meaning no exploitation context is confirmed by the vendor or intelligence community. The real-world priority depends heavily on whether the CTI-Transmute web interface is exposed to untrusted networks: organizations running it internet-facing without rate limiting or authentication controls face meaningful DoS risk, while air-gapped or internally restricted deployments are at substantially lower risk.

An unauthenticated attacker sends repeated HTTP GET requests to /activity_timeline?days=100000000 against an internet-exposed CTI-Transmute instance. Each request forces the application to execute unbounded database queries spanning implausibly large time windows, consuming significant DB I/O, CPU, and memory. Sustained repetition of this trivial single-parameter manipulation degrades or halts the service for legitimate analysts without requiring any exploit tooling beyond a basic HTTP client.