This module chains CVE-2026-27960 and CVE-2026-39980 to achieve unauthenticated remote command execution against vulnerable OpenCTI instances.
CVE-2026-27960 allows an unauthenticated attacker to authenticate to the GraphQL API using the UUID of an existing user as a bearer token. By default, this module uses OpenCTI's deterministic default administrator UUID. A different user UUID can be supplied with USER_ID.
After confirming the authentication bypass, the module locates the Platform mailer notification connector and exploits CVE-2026-39980, an EJS notifier template sanitizer bypass, to execute a Unix command in the OpenCTI Node.js process context.
The full unauthenticated chain applies where the affected version ranges overlap: OpenCTI 6.6.0 through 6.9.4.
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use exploit/linux/http/opencti/notifier_rcemsf undefined(notifier_rce) > show actions ...actions...msf undefined(notifier_rce) > set ACTION < action-name >msf undefined(notifier_rce) > show options ...show and set options...msf undefined(notifier_rce) > runWith curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub