A remote command execution flaw exists in MongoDB Ops Manager; administrators who can configure webhooks can embed FreeMarker template syntax that is executed on the server. The vulnerability is a classic command injection weakness (CWE‑77). An attacker who gains access to webhook configuration can run arbitrary shell commands with the privileges of the Ops Manager service, potentially compromising the entire server, its underlying OS, and any protected data.

All MongoDB Ops Manager 7.0 releases and all Ops Manager versions 8.0.22 and earlier are affected. The flaw is present in the Ops Manager product from MongoDB, Inc. Versions newer than 8.0.22, including 8.0.23 and later, contain the fix as announced in the release notes.

The CVSS score of 9.4 marks this as a critical vulnerability, and the EPSS score is currently not available, but a lack of mitigation in the field makes exploitation likely. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw by creating a malicious webhook from an administrative account and then sending a request to activate it, which is a feasible attack vector for insiders or compromised administrators.