This vulnerability (CVE-2026-8431) affects MongoDB Ops Manager 7.0 and 8.0.22 and earlier versions. It arises from improper neutralization of special elements in commands (CWE-77) within webhook configurations that use FreeMarker templates. An administrative user can inject and execute arbitrary commands by configuring and triggering malicious webhooks. The CVSS 4.0 base score is 9.4, indicating critical severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, availability, and security requirements. No official patch or remediation level has been published by MongoDB, Inc. The product is not a cloud service, so remediation depends on vendor updates or user action.

Successful exploitation allows an administrative user to execute arbitrary system commands on the server running MongoDB Ops Manager, potentially leading to full system compromise. This can affect confidentiality, integrity, and availability of the affected system. The vulnerability requires administrative privileges to configure webhooks, so exploitation is limited to trusted users with elevated access. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrative access to trusted personnel only and carefully audit webhook configurations. Avoid triggering untrusted or suspicious webhooks. Monitor vendor communications for updates on patches or official mitigations.