CVE-2026-39980 is a critical vulnerability in the OpenCTI-Platform's opencti product affecting versions before 6.9.5. The issue stems from improper neutralization of special elements in EJS templates (CWE-1336) within the safeEjs.ts file. Specifically, users granted the Manage customization capability can inject and execute arbitrary JavaScript code in the context of the platform process during notifier template execution. This can lead to complete compromise of confidentiality, integrity, and availability of the affected system. The vulnerability has a CVSS 3.1 base score of 9.1, indicating high exploitability and impact. The issue is resolved in version 6.9.5.

Successful exploitation allows privileged users to execute arbitrary JavaScript code within the OpenCTI platform process, potentially leading to full system compromise including data theft, modification, or denial of service. The vulnerability affects confidentiality, integrity, and availability at a critical level. There are no reports of known exploits in the wild at this time.

Upgrade OpenCTI-Platform to version 6.9.5 or later, where this vulnerability is fixed. Since the vulnerability requires Manage customization privileges, restricting this capability to trusted users can reduce risk. Patch status is not explicitly stated in vendor advisory content, but the description confirms the fix in version 6.9.5. No additional mitigations are indicated.