How severe is CVE-2026-3431?

CVE-2026-3431 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2026-3431 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (27th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-3431?

CVE-2026-3431 affects Sim. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-3431?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2026-3431 have an EU (EUVD) identifier?

Yes. CVE-2026-3431 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-9172.

When was CVE-2026-3431 published?

CVE-2026-3431 was published on 2026-03-02 and last updated on 2026-06-17.

CVE-2026-3431

CVE-2026-3431 is a critical-severity vulnerability in Sim with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-862.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
EPSS exploit prediction: 0% (27th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-9172
Weakness: CWE-862
Affected product: Sim
Published: 2026-03-02
Last modified: 2026-06-17

Description

On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller without authentication or host restrictions. An attacker can leverage these endpoints to connect to any reachable MongoDB instance and perform unauthorized operations including reading, modifying, and deleting data.

Frequently asked questions

What is CVE-2026-3431?: On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller without authentication or host restrictions. An attacker can leverage these endpoints to connect to any reachable MongoDB instance and perform unauthorized operations including reading, modifying, and deleting data.
How severe is CVE-2026-3431?: CVE-2026-3431 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2026-3431 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (27th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-3431?: CVE-2026-3431 affects Sim. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-3431?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2026-3431 have an EU (EUVD) identifier?: Yes. CVE-2026-3431 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-9172.
When was CVE-2026-3431 published?: CVE-2026-3431 was published on 2026-03-02 and last updated on 2026-06-17.

References

https://www.tenable.com/security/research/tra-2026-12

Affected products (1)

cpe:2.3:a:sim:sim:*:*:*:*:*:*:*:*

More vulnerabilities in Sim

CVE-2026-3432 — Critical (CVSS 9.1): On SimStudio version below to 0.5.74, the `/api/auth/oauth/token` endpoint contains a code path that bypasses all…
CVE-2025-15099 — High (CVSS 7.3): A vulnerability was identified in simstudioai sim up to 0.5.27. This vulnerability affects unknown code of the file…
CVE-2025-7114 — High (CVSS 7.3): A vulnerability was found in SimStudioAI sim up to 37786d371e17d35e0764e1b5cd519d873d90d97b. It has been declared as…
CVE-2025-10097 — Medium (CVSS 6.3): A vulnerability was identified in SimStudioAI sim up to 1.0.0. This impacts an unknown function of the file…
CVE-2025-10096 — Medium (CVSS 6.3): A vulnerability was determined in SimStudioAI sim up to 1.0.0. This affects an unknown function of the file…
CVE-2025-9805 — Medium (CVSS 6.3): A vulnerability was found in SimStudioAI sim up to 51b1e97fa22c48d144aef75f8ca31a74ad2cfed2. This issue affects some…

All CVEs affecting Sim →

Other CWE-862 (Missing Authorization) vulnerabilities

CVE-2026-0092 — Critical (CVSS 10.0): In Package Manager, there is a possible device lock controller bypass due to a missing permission check. This could…
CVE-2026-33712 — Critical (CVSS 10.0): Typebot is a chatbot builder tool. In versions 3.15.2 and prior, the preview chat endpoint (POST…
CVE-2026-2031 — Critical (CVSS 10.0): An Improper Access Control vulnerability in several internal API endpoints for Google Cloud Application Integration…
CVE-2026-34976 — Critical (CVSS 10.0): Dgraph is an open source distributed GraphQL database. Prior to 25.3.1, the restoreTenant admin mutation is missing…
CVE-2025-30416 — Critical (CVSS 10.0): Sensitive data disclosure and manipulation due to missing authorization. The following products are affected: Acronis…
CVE-2025-45854 — Critical (CVSS 10.0): /server/executeExec of JEHC-BPM 2.0.1 allows attackers to execute arbitrary code via execParams.

Browse all CWE-862 (Missing Authorization) vulnerabilities →