CVE-2026-18709: MongoDB

Medium severity, CVSS 6.4. EPSS: 0.2% chance of exploitation in the next 30 days.

An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination process. This could result in cross-shard data inconsistency, cluster clock corruption, and violation of transaction atomicity guarantees.

Affected products

• MongoDB MongoDB: from 7.0.0, before 7.0.40 (fixed in 7.0.40); from 8.0.0, before 8.0.29 (fixed in 8.0.29); from 8.2.0, up to and including 8.2.12; from 8.3.0, before 8.3.8 (fixed in 8.3.8); version 9.0.0 only; version 9.1.0 only

Published 2026-08-11. Last modified 2026-09-16.