CVE-2026-18707: MongoDB

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

An issue in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the server process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service.

Affected products

• MongoDB MongoDB: from 7.0.0, before 7.0.40 (fixed in 7.0.40); from 8.0.0, before 8.0.29 (fixed in 8.0.29); from 8.2.0, up to and including 8.2.12; from 8.3.0, before 8.3.8 (fixed in 8.3.8); version 9.0.0 only; version 9.1.0 only

Published 2026-08-11. Last modified 2026-09-16.