PatchTheCEVmongodb vulnerabilities and fixes
Recent CVEs affecting mongodb, with upgrade or downgrade steps. 20 tracked.
mongodb has 20 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 20. Most recent: 2026-08-11. Highest priority: CVE-2026-18692 (score 42/100).
- CVE-2026-18692 HIGH 8.8 UPGRADE DOWNGRADE An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with wr
- CVE-2026-18697 HIGH 7.5 UPGRADE DOWNGRADE An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (rou
- CVE-2026-18691 HIGH 8.8 UPGRADE DOWNGRADE An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access t
- CVE-2026-18690 HIGH 8.1 UPGRADE DOWNGRADE An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an
- CVE-2026-18688 HIGH 7.1 UPGRADE DOWNGRADE An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of-boun
- CVE-2026-18693 HIGH 7.6 UPGRADE DOWNGRADE An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write p
- CVE-2026-18694 HIGH 7.1 UPGRADE DOWNGRADE An issue in MongoDB Server's geospatial query processing could allow an authenticated user with write privileg
- CVE-2026-18706 MEDIUM 6.6 UPGRADE DOWNGRADE An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue ag
- CVE-2026-18695 MEDIUM 6.5 UPGRADE DOWNGRADE An issue in MongoDB Server's handling of certain query predicates against time-series collections with a metaF
- CVE-2026-18696 MEDIUM 6.5 UPGRADE DOWNGRADE An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-default priv
- CVE-2026-18699 MEDIUM 6.5 UPGRADE DOWNGRADE An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cau
- CVE-2026-18700 MEDIUM 6.5 UPGRADE DOWNGRADE An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to
- CVE-2026-18701 MEDIUM 6.5 UPGRADE DOWNGRADE An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause t
- CVE-2026-18705 MEDIUM 6.5 UPGRADE DOWNGRADE An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to
- CVE-2026-18687 HIGH 7.1 UPGRADE DOWNGRADE MongoDB Server's handling of a Queryable Encryption maintenance operation did not properly validate certain re
- CVE-2026-18702 MEDIUM 6.4 UPGRADE DOWNGRADE An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modif
- CVE-2026-18704 MEDIUM 6.5 UPGRADE An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges
- CVE-2026-18709 MEDIUM 6.4 UPGRADE DOWNGRADE An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improper
- CVE-2026-18698 MEDIUM 5.4 UPGRADE DOWNGRADE An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an
- CVE-2026-18703 MEDIUM 4.2 UPGRADE DOWNGRADE An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user accoun
FAQ
How do I fix mongodb vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is mongodb being exploited right now?
None of the tracked mongodb CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which mongodb CVE should I patch first?
CVE-2026-18692 currently ranks highest (42/100): An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with wr.