CVE-2026-3431

9.8 criticalEPSS 0.4%

Critical (9.8) in sim sim. EPSS 0.4% chance of exploitation in the next 30 days.

On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller without authentication or host restrictions. An attacker can leverage these endpoints to connect to any reachable MongoDB instance and perform unauthorized operations including reading, modifying, and deleting data.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 34% of CVEs (scores of 2026-10-31)
CWE: CWE-862
Published: 2026-03-02
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

sim:sim

References

https://www.tenable.com/security/research/tra-2026-12

Check your stack JSON