Which versions of MongoDB Server are affected by CVE-2026-13072?

A critical memory corruption vulnerability in MongoDB standalone servers running in compute mode could allow remote attackers to crash database services, causing operational disruption and data…. A patch is available.

How to fix or mitigate CVE-2026-13072?

Within 24 hours, inventory all MongoDB servers to identify which are running in compute mode, as only these instances are vulnerable. Within 7 days, implement network segmentation to restrict BSON data ingestion sources, disable compute mode if not operationally required, and establish monitoring for abnormal aggregation pipeline requests. Within 30 days, evaluate MongoDB compute mode necessity across your environment, monitor vendor advisories for security patches, and plan remediation timelines with MongoDB operations teams.

MongoDB Server CVE-2026-13072

Q: What is the CVSS score of CVE-2026-13072?

CVE-2026-13072 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-47789 CRITICAL

Heap-based Buffer Overflow (CWE-122)

2026-07-22 cna@mongodb.com

Buffer Overflow Heap Overflow MongoDB

9.2

CVSS 4.0 · Vendor: mongodb

Severity by source

Vendor (mongodb) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.0 HIGH

Network-reachable with no privileges but high complexity and a non-default mode requirement (AC:H); demonstrated impact is process crash (A:H), with only theoretical, unproven confidentiality/integrity effects from heap corruption (C:L/I:L).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mongodb).

CVSS VectorVendor: mongodb

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 22, 2026 - 21:03 EUVD

Analysis Generated

Jul 22, 2026 - 20:36 vuln.today

CVE Published

Jul 22, 2026 - 20:16 cve.org

CRITICAL 9.2

DescriptionCVE.org

When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potentially leading to process termination or other unintended behavior. This configuration is non-default and requires explicit enablement at startup.

AnalysisAI

Memory corruption in MongoDB standalone mongod servers running with compute mode enabled allows remote attackers to crash the process (denial of service) or trigger undefined behavior by supplying maliciously crafted BSON data that is mishandled during aggregation pipeline processing (CWE-122 heap overflow). Only servers explicitly started in the non-default compute mode are affected. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the vendor rates it CVSS 4.0 9.2 (Critical) despite high attack complexity and a required precondition.

Technical ContextAI

The flaw resides in MongoDB's aggregation pipeline engine, which parses and processes BSON (Binary JSON) documents supplied by clients. When the server runs in 'compute mode' - a non-default operating mode that must be explicitly enabled at mongod startup - externally sourced BSON is processed without sufficient validation, permitting an out-of-bounds write consistent with CWE-122 (Heap-based Buffer Overflow), as confirmed by the vendor tags 'Buffer Overflow' and 'Heap Overflow'. BSON is MongoDB's native binary serialization format, and aggregation pipelines are a core query facility; a length/size field or nested structure that is trusted rather than bounds-checked can drive a write past an allocated heap buffer, corrupting adjacent heap metadata or objects. No CPE list was provided in the input, so exact affected build ranges are not enumerated here and must be taken from the vendor advisory (MongoDB SERVER-128494).

RemediationAI

Upgrade mongod to the MongoDB-released fixed version tracked in SERVER-128494 (https://jira.mongodb.org/browse/SERVER-128494); the input does not contain an exact fix version, so consult that advisory for the specific patched build and do not rely on an invented version number. As an immediate compensating control where patching is not yet possible, disable compute mode - the vulnerable configuration is non-default, so restarting mongod without the compute-mode startup option removes exposure entirely, at the cost of losing whatever compute-mode functionality the workload depends on. Additionally, restrict network access to the mongod port (default 27017) to trusted application hosts via firewall/security-group rules and require authentication, so that only vetted clients can submit aggregation queries; this reduces the population of potential attackers but does not fix the underlying overflow if a trusted client is compromised.