Which versions of MongoDB Server are affected by CVE-2026-18692?

MongoDB Server contains a use-after-free vulnerability in timeseries bucket lifecycle handling (CVE-2026-18692, CVSS 7.7) allowing authenticated users with write privileges to crash server processes…. A patch is available.

How to fix or mitigate CVE-2026-18692?

Within 24 hours, inventory MongoDB Server instances, identify those with timeseries collections, and audit accounts with write-level database access. Within 7 days, implement or strengthen role-based access control (RBAC) policies to restrict write privileges to timeseries collections to essential service accounts only, and enable audit logging for timeseries write operations. Within 30 days, establish monitoring and alerting for MongoDB server crashes and unexpected process terminations, document current MongoDB versions across the environment, and prepare deployment procedures for the vendor-released patch with a 48-hour deployment target once available.

MongoDB Server CVE-2026-18692

Q: What is the CVSS score of CVE-2026-18692?

CVE-2026-18692 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-56905 HIGH

Use After Free (CWE-416)

2026-08-11 mongodb

GHSA-5v9h-3hj6-76w4

Denial Of Service Use After Free Memory Corruption MongoDB Mongodb Server

7.7

CVSS 4.0 · Vendor: mongodb

Severity by source

Vendor (mongodb) PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-reachable but requires write-privileged authentication and a specific lifecycle prerequisite (AT:P maps to AC:H in 3.1); no scope change; full C/I/A impact from potential code execution and server crash.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mongodb).

CVSS VectorVendor: mongodb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 11, 2026 - 20:19 EUVD

Analysis Generated

Aug 11, 2026 - 20:18 vuln.today

CVE Published

Aug 11, 2026 - 18:36 cve.org

HIGH 7.7

DescriptionCVE.org

An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed. Subsequent operations could then result in a server crash or, potentially, execution of unintended code.

AnalysisAI

Use-after-free in MongoDB Server's timeseries bucket lifecycle handling allows an authenticated user with write-level privileges to corrupt internal server memory, potentially crashing the server process or executing unintended code. The CVSS 4.0 score of 7.7 reflects a network-reachable vulnerability tempered by a low-privilege authentication requirement and a specific attack prerequisite (AT:P), indicating the flaw requires a particular lifecycle state in timeseries collections rather than a simple, reliable trigger. No public exploit code exists and this vulnerability has not been confirmed as actively exploited at time of analysis.

Technical ContextAI

MongoDB Server implements timeseries collections using a bucket-based internal data model in which documents are grouped by time intervals and metadata fields; lifecycle management governs when those buckets are created, merged, and reclaimed. CWE-416 (Use After Free) identifies the root cause class: when a memory region is deallocated but an internal pointer referencing it is not cleared, a subsequent operation dereferencing that stale pointer can corrupt heap metadata, trigger an assertion or segfault that crashes the server process, or - under controlled conditions - redirect execution to attacker-influenced memory. The CPE string cpe:2.3:a:mongodb:mongodb_server:*:*:*:*:*:*:*:* covers all tracked versions of MongoDB Server without bounding a minimum or maximum version, meaning exact affected release ranges are not confirmed from currently available data.

RemediationAI

No vendor-released patch has been identified at time of analysis; the MongoDB JIRA ticket SERVER-129887 at https://jira.mongodb.org/browse/SERVER-129887 is the sole available reference and should be monitored for fix version announcements and release notes. Until a patched build is confirmed, organizations should restrict write-level MongoDB credentials to the minimum necessary set of accounts and audit which deployments actively use timeseries collections, since the vulnerable code path is specific to that feature. Disabling or avoiding timeseries collection usage entirely eliminates the attack surface described in this CVE, but this trade-off is only viable where the application does not depend on that feature. Ensuring MongoDB instances are not directly reachable from untrusted networks via firewall or VPN controls raises the bar for exploitation even if write credentials are compromised. Monitor MongoDB release channels for a patched version announcement before confirming remediation.