Is CVE-2026-35211 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-35211 being exploited in the wild.

How severe is CVE-2026-35211?

Medium severity, with a CVSS score of 6.5, published 8 July 2026.

Which products and versions are affected?

pycti (PyPI) ECOSYSTEM:introduced=0,fixed=7.260401.0.

Is there a fix for CVE-2026-35211?

Yes. pycti (PyPI): upgrade to 7.260401.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-35211 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-35211?

Check whether you run pycti (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-35211: Filigran OpenCTI Code Injection in GraphQL API

CVE-2026-35211 · Severity: medium · CVSS 6.5 · Published 2026-07-08

OpenCTI is an open-source platform used by organizations to manage and analyze cyber threat intelligence. A security flaw in its search interface allows authorized users to run complex, unoptimized scripts on the underlying database server. An attacker could use this to overwhelm the system's processor, causing the platform to become slow or completely unavailable for all other users.

Technologies: pycti (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-35211 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-35211 being exploited in the wild.
How severe is CVE-2026-35211?: Medium severity, with a CVSS score of 6.5, published 8 July 2026.
Which products and versions are affected?: pycti (PyPI) ECOSYSTEM:introduced=0,fixed=7.260401.0.
Is there a fix for CVE-2026-35211?: Yes. pycti (PyPI): upgrade to 7.260401.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35211 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-35211?: Check whether you run pycti (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pycti (PyPI): upgrade to 7.260401.0 or later
```
pip install "pycti>=7.260401.0"
```

Technical details

A code injection vulnerability exists in the OpenCTI GraphQL API due to improper neutralization of user-supplied input in the FilterOperator enum. Authenticated users with the 'KNOWLEDGE' capability can provide arbitrary Elasticsearch Painless scripts via the 'script' filter operator. Because these scripts are passed to the Elasticsearch backend without validation or sanitization, an attacker can execute computationally intensive operations, such as infinite loops. This results in a Denial of Service (DoS) by exhausting cluster CPU resources. The issue is resolved in version 7.260401.0 by removing the script filter from the public API by default.

Affected products

Filigran OpenCTI < 7.260401.0

Identifiers

CVE-2026-35211
PYSEC-2026-3446

Timeline

2026-03-31: patched: Fix committed to backend to move script usage to internal_script
2026-04-01: advisory: Release 7.260401.0 published
2026-07-01: disclosed: GitHub Security Advisory published
2026-07-08: advisory: NVD published CVE-2026-35211

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.