PT-2026-70862

Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description An issue allows an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction. This bypasses the intended transaction...

PT-2026-70857

Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description A flaw in the query subsystem allows an authenticated user with read privileges to trigger an unexpected termination of the server process. This is achieved by submitting a specially...

PT-2026-70852

Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description An issue in the applyOps command allows an authenticated user with specific non-default privileges to perform unauthorized data-definition operations, such as dropping or modifying...

PT-2026-70853

Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description An issue in the aggregation framework allows an unauthenticated party to cause a mongos router process to terminate unexpectedly by submitting a specially formed aggregation command...

CVE-2026-18709: Missing Authorization

An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination process. This could result in cross-shard data inconsistency, cluster clock...

PT-2026-70836

Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description An issue exists in the handling of a Queryable Encryption maintenance operation where certain request parameters are not properly validated against the encrypted field configuration of...

CVE-2026-18707: Reachable Assertion

An issue in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the server process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service...

CVE-2026-18703: Incorrect Authorization

An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authenticate using a certificate-based authentication method, even when an administrator has configured the server to restrict authentication to other mechanisms. This could allow...

CVE-2026-18702: Improper Privilege Management

An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings that affect the entire server rather than just the intended database. This could allow suppression of diagnostic logging server-wide, potentially obscuring...

CVE-2026-18701: Access of Resource Using Incompatible Type

An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause the server process to terminate unexpectedly by submitting a specially formed query filter. This could result in a denial of service...

CVE-2026-18696: Incorrect Authorization

An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-default privileges to perform certain data-definition operations, such as dropping or modifying collections, against collections they do not have permission to manipulate. This is due to an...

CVE-2026-18687: Integer Underflow (Wrap or Wraparound)

MongoDB Server's handling of a Queryable Encryption maintenance operation did not properly validate certain request parameters against the collection's encrypted field configuration before use. An authenticated user with readWrite privileges could submit a specially formed request that leads to a...

CVE-2026-18693: Out-of-bounds Write

An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges to cause an internal data structure to become inconsistent through certain document insertions. A subsequent insert into the affected bucket could then result in the server...

PT-2026-70863

Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description An issue in the query execution engine allows an authenticated user with read and write privileges to trigger a use-after-free condition when executing specific queries against...

PT-2026-70837

Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description An issue exists in the handling of certain query predicates against time-series collections that utilize a metaField. This flaw allows an authenticated user with write access to trigge...

PT-2026-70859

Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description An issue in the aggregation framework allows an authenticated user with read-only privileges to execute write operations on collections they are not authorized to modify. This occurs...

PT-2026-70855

Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description A flaw in the query planner allows an authenticated user with read-level privileges to trigger an unexpected termination of the server process. This occurs when a specially formed quer...

PT-2026-70861

Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description An issue in the JavaScript scripting engine allows an authenticated user with write privileges to execute controlled code within the query scope of other users. This occurs when a...

CVE-2026-18688: Out-of-bounds Read

An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of-bounds memory read by providing a specially formed numeric parameter in a certain aggregation pipeline stage. This could result in a server crash denial of service and may potentially expose ...

PT-2026-70864

Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description An issue in Queryable Encryption maintenance operations allows an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of da...