Release Date: 10 November 2026

Release (1.15.7)

Patch release

  • All releases from Neo4j Ops Manager 1.15.0 and later require Neo4j persistence to be version 5.26 LTS or greater. 
  • Monitoring instances with versions of 4.4 LTS and greater is still supported, although 4.4 LTS is out of support with Neo4j.
See Version Compatibility Docs

Changes

For docker deployments of Neo4j Ops Manager, releases from 1.15.6 replaces all base docker images with appropriate distroless images for better security and smaller docker images. Please see release note for 1.15.6 for more details. This is a security fix release addressing a number of issues.

Internal

Fixes for the following CVEs
  • CVE-2026-111943
  • CVE-2026-109829
  • CVE-2026-109383
  • CVE-2026-87018
  • CVE-2026-109869
  • CVE-2026-90711
  • CVE-2026-19481
  • CVE-2026-112942
  • CVE-2026-111756
  • CVE-2026-111755
  • CVE-2026-93749
  • CVE-2026-102422
  • CVE-2026-103921
  • CVE-2026-19484
  • CVE-2026-102990
  • CVE-2026-102278
  • CVE-2026-102276
  • CVE-2026-84375
  • CVE-2026-14257
  • CVE-2026-69152
  • CVE-2026-59869
  • CVE-2026-13149
Internal: Version updates & fixes
  • nodejs version to 24.22.2
  • shell-quote to 1.12.0
  • proxy-addr to 2.0.8
  • fix bug where the security tab fails to list users with non-native authorization
  • neo4j-go-driver/v5 to 5.28.6
  • caffeine to 3.3.1
  • byte-buddy to 1.18.15
  • grpc.version to 1.85.1
  • prometheus/common to 0.72.1
  • tomcat-embed-core to 11.0.27
  • json-schema-validator to 3.0.8
  • maven-model to 3.10.0
  • go to 1.26.10
  • spring-boot.version to 4.1.2
  • grpc to 1.85.0
  • distroless/static-debian13 to 25ac8f0
  • ubuntu to 6a06111
  • distroless/java21-debian13 to fb4ca73
  • guava to 33.7.2-jre
  • jackson-databind to 3.2.4

Known issues

There are still some known vulnerabilities in the docker base image (debian 13.7) for :
  • CVE-2026-117610
  • CVE-2026-118370
  • CVE-2026-76642
  • CVE-2026-78408
  • CVE-2026-78409
  • CVE-2026-78410
The NOM image is not necessarily vulnerable just because those CVEs exist in the base image.

Some vulnerability scanner might also report CVE-2026-102554 in app.jar. This is a false positive. Only the fixed version of guava (33.7.2-jre) is being used.

Recent Neo4j Operations Manager Releases

See All Neo4j Operations Manager Releases →