CVE-2016-0883: Pivotal Software Operations Manager

Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days.

Pivotal Cloud Foundry (PCF) Ops Manager before 1.5.14 and 1.6.x before 1.6.9 uses the same cookie-encryption key across different customers' installations, which allows remote attackers to bypass session authentication by leveraging knowledge of this key from another installation.

Affected products

• Pivotal Software Operations Manager: up to and including 1.5.13; version 1.6.0 only; version 1.6.1 only; version 1.6.2 only; version 1.6.3 only; version 1.6.4 only; …

Published 2016-09-18. Last modified 2026-06-17.