MongoDB Java Driver vulnerabilities

4 CVEs affecting MongoDB Java Driver, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-88033, published 2026-09-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-88033, published 2026-09-10. High severity, CVSS 8.3. EPSS: 0.5% chance of exploitation in the next 30 days. Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause a caller-supplied structured file identifier to be interpreted as a query…
CVE-2021-20328, published 2021-02-25. Medium severity, CVSS 6.8. EPSS: 0.4% chance of exploitation in the next 30 days. Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in…
CVE-2026-88032, published 2026-09-10. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted operation is still using them when the…
CVE-2026-18710, published 2026-08-11. Medium severity, CVSS 6.5. EPSS: 0.1% chance of exploitation in the next 30 days. A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client…