CVE-2026-87109Medium· 5.3▾ SunlitAn authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that member's enrollment is unconfirmed. This results in disclosure of secret authe…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
0.2% → 0.2%
An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that member's enrollment is unconfirmed. This results in disclosure of secret authentication material to another member of the same organization or project.
ops_manager >= 7.0.0, < 7.0.23ops_manager >= 8.0.0, < 8.0.27Upgrade past the affected range:
ops_manager 8.0.27Connected by shared product, vendor, weakness, or advisory.
CVE-2026-87110Medium· 5.3An unauthenticated user with network access to the Ops Manager web port can repeatedly request monitoring endpoints that perform costly work without rate limiting
CVE-2026-87108Low· 3.1An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the required record identifier
CVE-2026-8431High· 7.2An administrative user with access to configure webhooks can execute arbitrary commands by configuring and then triggering webhooks containing specific FreeMarker template syntax. This issue affects all MongoDB Ops Manager 7.0 versio…
CVE-2026-118510High· 8.8Laravel MongoDB `whereDoesntHave` misses deny records for numeric string IDs
CVE-2026-118581Medium· 6.5NoSQL injection via mismatched BSON size prefix in raw document splice to the wire protocol
CVE-2026-114650Medium· 5.9Plaintext exposure of encrypted fields via ANSI code-page corruption of database name