Description
This module chains CVE-2026-27960 and CVE-2026-39980 to achieve unauthenticated remote command execution against vulnerable OpenCTI instances.
CVE-2026-27960 allows an unauthenticated attacker to authenticate to the GraphQL API using the UUID of an existing user as a bearer token. By default, this module uses OpenCTI's deterministic default administrator UUID. A different user UUID can be supplied with USER_ID.
After confirming the authentication bypass, the module locates the Platform mailer notification connector and exploits CVE-2026-39980, an EJS notifier template sanitizer bypass, to execute a Unix command in the OpenCTI Node.js process context.
The full unauthenticated chain applies where the affected version ranges overlap: OpenCTI 6.6.0 through 6.9.4.
Module options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use exploit/linux/http/opencti/notifier_rcemsf undefined(notifier_rce) > show actions ...actions...msf undefined(notifier_rce) > set ACTION < action-name >msf undefined(notifier_rce) > show options ...show and set options...msf undefined(notifier_rce) > runPrioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub