CVE-2026-87110— Ops Manager Uncontrolled Resource Consumption in Monitoring Endpoints
Quick assessment
Affected
MongoDB Ops Manager
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
未经身份验证的用户，只要通过网络访问 Ops Manager 的 Web 端口，就可以反复请求执行高开销操作的监控端点，而服务器未对这些请求实施速率限制。这种攻击可能导致同一服务进程在处理这些请求期间，暂时减缓其他正常流量的响应速度。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-87110
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Ops Manager Uncontrolled Resource Consumption in Monitoring Endpoints
Source: CVE Program / CVE List V5
Vulnerability Description
An unauthenticated user with network access to the Ops Manager web port can repeatedly request monitoring endpoints that perform costly work without rate limiting. This can temporarily slow other traffic served by the same process while requests continue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| MongoDB | Ops Manager | 7.0.0 ~ 7.0.23 | - |
|
II. Public POCs for CVE-2026-87110
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-87110
请登录查看更多情报信息。
Other References for CVE-2026-87110 (1)
Same Patch Batch · MongoDB · 2026-10-09 · 3 CVEs total
| CVE-2026-87109 | 5.3 MEDIUM | Ops Manager Sensitive MFA Enrollment Information Exposure in User Listings |
| CVE-2026-87108 | 3.1 LOW | Ops Manager Improper Authorization in Daily Host Monitoring Retrieval |
IV. Related Vulnerabilities
Same vendor: MongoDB
-
CVE-2026-87109
Ops Manager Sensitive MFA Enrollment Information Exposure in -
CVE-2026-87108
Ops Manager Improper Authorization in Daily Host Monitoring -
CVE-2026-106435
Application denial of service via out-of-bounds read in BSON -
CVE-2026-106436
Application denial of service and data truncation via unchec -
CVE-2026-106432
Heap buffer overflow via 32-bit string-length truncation in
Same weakness: CWE-770
-
CVE-2026-107885
CUPS<=2.4.20资源耗尽漏洞 -
CVE-2026-78399
Security vulnerabilities have been found in IBM Verify Ident -
CVE-2026-107386
amqp091-go: Pre-negotiation frame limit is not enforced to 4 -
CVE-2026-107379
enshrined/svg-sanitize: Denial of Service via DTD Attribute -
CVE-2026-107586
Allocation of Resources Without Limits or Throttling in hMai
V. Comments for CVE-2026-87110
No comments yet