PT-2026-31664 · Opencti · Opencti

CVE-2026-39980 · Published 2026-04-09 · Updated 2026-04-28

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenCTI versions prior to 6.9.5

Description OpenCTI is a platform for managing cyber threat intelligence. Prior to version 6.9.5, the safeEjs.ts file does not properly sanitize EJS templates. Users with Manage customization capability can execute arbitrary JavaScript in the context of the OpenCTI platform process during notifier template execution.

Recommendations Update to version 6.9.5 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-1336

Related Identifiers

CVE-2026-39980

GHSA-JV9R-JW2F-RHRF

PYSEC-2026-2265

Affected Products

Opencti

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39980.json · Exploit
• https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-jv9r-jw2f-rhrf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39980 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-2265 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-39980 · Vendor Advisory
• https://github.com/OpenCTI-Platform/opencti/releases/tag/6.9.5 · Note
• https://twitter.com/CVEnew/status/2042302788609458492 · Twitter Post
• https://twitter.com/cybrsecpath/status/2048973692999467396 · Twitter Post
• https://twitter.com/CveFindCom/status/2042312362682622245 · Twitter Post
• https://twitter.com/0dayPublishing/status/2042292602955841949 · Twitter Post
• https://twitter.com/cybrsecpath/status/2046993308480885127 · Twitter Post