CVE-2026-87109
Ops Manager Sensitive MFA Enrollment Information Exposure in User Listings
MongoDB Ops ManagerDatabasesCVSS
6.0MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.23%Chance of exploitation activity in the next 30 days, higher than 12% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 8.0.27Ops ManagerCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that member's enrollment is unconfirmed. This results in disclosure of secret authentication material to another member of the same organization or project.
Text from CVE List
Affected versions 2
- Ops Manageraffected: 7.0.0 through 7.0.23CVE List
- Ops Manageraffected: 8.0.0 before 8.0.27CVE List