MongoDB Ops Manager CVE-2026-87110

Exploitation requires network reachability to the MongoDB Ops Manager web/HTTP port and targets the unauthenticated monitoring endpoints, which perform costly work without rate limiting (the missing throttling control is the core condition, CWE-770). No authentication, user interaction, or special configuration is required - it works against default configurations (PR:N/UI:N/AC:L). What limits impact: the effect is confined to temporary slowdown of other traffic served by the same process (VA:L) and persists only while the attacker sustains the request flood; there is no confidentiality or integrity impact and no crash or permanent denial, so an attacker must maintain continuous traffic to have any effect.

Using the vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) this is remotely reachable and unauthenticated with low attack complexity, which raises exposure, but the impact metrics are the decisive signal: only VA:L (low availability impact) with VC:N/VI:N and no subsequent-system impact (SC/SI/SA:N). The description confirms this is a temporary performance degradation of co-tenant traffic on the same process, not a crash or full outage, so the 6.9 'medium' score accurately reflects a nuisance-grade resource-exhaustion issue (CWE-770) rather than a critical flaw. No EPSS score was provided, the CVE is not in CISA KEV, and no public exploit was referenced - so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: low-to-moderate real-world priority - patch during normal maintenance cycles rather than as an emergency, prioritizing internet-exposed Ops Manager instances. One caveat: no EPSS value was supplied in the input, so exploitation-probability cannot be compared against the KEV/POC signals here.

A remote attacker with only network reachability to the Ops Manager web port scripts a high-rate loop of requests against the unauthenticated monitoring endpoints, each of which performs costly server-side work. Sustained request volume consumes CPU/processing capacity in the serving process, temporarily slowing legitimate traffic handled by that same process. No exploit code was referenced in the provided data.