All vulnerabilities
CVE-2026-87110

Ops Manager Uncontrolled Resource Consumption in Monitoring Endpoints

MongoDB Ops ManagerDatabases
Open in ThreatlineRecord JSON
CVSS
6.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.25%Chance of exploitation activity in the next 30 days, higher than 15% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in8.0.27Fixed versionCVE List
Published9 Oct 2026Updated 13 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

An unauthenticated user with network access to the Ops Manager web port can repeatedly request monitoring endpoints that perform costly work without rate limiting. This can temporarily slow other traffic served by the same process while requests continue.

Text from CVE List

Affected versions 2

  • Ops Manageraffected: 7.0.0 through 7.0.23CVE List
  • Ops Manageraffected: 8.0.0 before 8.0.27CVE List

References 1