PatchTheCVEc\# driver vulnerabilities and fixes
Recent CVEs affecting c\# driver, with upgrade or downgrade steps. 6 tracked.
Also searched as: c\#driver.
c\# driver has 6 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 6. Most recent: 2026-09-10. Highest priority: CVE-2026-88025 (score 39/100).
- CVE-2026-81527 MEDIUM 6.5 UPGRADE A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB
- CVE-2026-81528 MEDIUM 5.4 UPGRADE A MongoDB C# driver document-replacement code path omits the element-name/shape validation that the equivalent
- CVE-2026-81529 HIGH 7.1 UPGRADE Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the
- CVE-2026-81530 MEDIUM 5.6 UPGRADE A weakness in the client-side encryption configuration surface of the MongoDB C# Driver causes sensitive key-m
- CVE-2026-88025 HIGH 8.3 UPGRADE Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C# Driv
- CVE-2026-88026 MEDIUM 6.5 UPGRADE Improper neutralization of regular-expression metacharacters in the LINQ query translation component of the Mo
FAQ
How do I fix c\# driver vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is c\# driver being exploited right now?
None of the tracked c\# driver CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which c\# driver CVE should I patch first?
CVE-2026-88025 currently ranks highest (39/100): Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C# Driv.