CVE-2026-27960
Attackers can take over an OpenCTI instance via default admin account.
OpenCTI, a platform for threat intelligence, has a flaw in versions 6.6.0 through 6.9.12 that lets an unauthenticated attacker use the API to gain the privileges of any user, including the default administrator. This gives control of the system. A fix is available in version 6.9.13.
OpenCTI-Platform opencti · Updated 28 Oct · From the public records
Being exploitedNot reportedNo attacks reported in the records
CISA known exploitedNot listedThe US list of flaws under attack
SeveritycriticalCVSS 9.8 of 10
FixNot yetSee what to do below
Am I affected?
The records do not list fixed versions yet. Check the vendor's advisory below.
What to do
- Update OpenCTI to version 6.9.13 to fix the vulnerability.
- As a workaround, disable the default admin account by setting `APP__ADMIN__EXTERNALLY_MANAGED` in the configuration, as advised by the vendor.
What happened
- 23 OctRapid7 includes the vulnerability in its Metasploit Wrap Up, with Langflow, MongoDB, and more.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-27960 | OpenCTI privilege escalation and unauthenticated access via default admin account | critical 9.8 | No | 7.1% |
Our reporting
We have not reported on it. It is here because the sources below did.
Reported elsewhere
Rapid7 · 23 OctMetasploit Wrap Up: Langflow, MongoDB, and More ↗The records
CVE-2026-27960 on NVD ↗Is anything you run affected?Members connect Zotpaper to their AI assistant. It checks your own project against every vulnerability on this page and the others we track, and says what to update.
How it works