Which versions of MongoDB Server are affected by CVE-2026-18693?

A memory corruption vulnerability in MongoDB Server's timeseries collection handling allows authenticated users with database write privileges to crash the database or expose sensitive in-process…. A patch is available.

How to fix or mitigate CVE-2026-18693?

Within 24 hours, audit your MongoDB deployment to identify instances using timeseries collections and verify current authentication configurations. Within 7 days, implement principle-of-least-privilege access controls limiting database write permissions to only essential application service accounts, enable database audit logging to detect suspicious writes to timeseries collections, and establish baseline performance metrics. Within 30 days, subscribe to MongoDB security advisories for patch notification, review options to minimize timeseries collection usage where feasible, and conduct a targeted security assessment of any timeseries workloads.

MongoDB Server CVE-2026-18693

Q: What is the CVSS score of CVE-2026-18693?

CVE-2026-18693 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-56909 HIGH

Out-of-bounds Write (CWE-787)

2026-08-11 mongodb

GHSA-4f9m-g9cm-wxq9

Buffer Overflow Denial Of Service Memory Corruption MongoDB Mongodb Server

7.2

CVSS 4.0 · Vendor: mongodb

Severity by source

Vendor (mongodb) PRIMARY

7.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.6 HIGH

Requires authenticated write access to timeseries collections (PR:L); no scope change as impact is confined to the MongoDB server process; high availability from crash, low C/I from limited memory exposure and corruption.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mongodb).

CVSS VectorVendor: mongodb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 11, 2026 - 20:19 EUVD

Analysis Generated

Aug 11, 2026 - 20:17 vuln.today

CVE Published

Aug 11, 2026 - 18:38 cve.org

HIGH 7.2

DescriptionCVE.org

An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges to cause an internal data structure to become inconsistent through certain document insertions. A subsequent insert into the affected bucket could then result in the server accessing memory outside its intended bounds, potentially causing a server crash (denial of service), exposure of limited memory contents, or memory corruption.

AnalysisAI

Memory corruption in MongoDB Server's timeseries collection handling allows an authenticated user with write privileges to corrupt internal bucket data structures through crafted document insertions, then trigger out-of-bounds memory access via a subsequent insert. The impact spans denial of service via server crash, limited exposure of in-process memory contents, and memory corruption - all achievable without complex prerequisites beyond low-privilege authentication. No public exploit is identified at time of analysis, but the CVSS 4.0 score of 7.2 reflects the high availability impact against a widely deployed database platform.

Technical ContextAI

MongoDB's timeseries collections store time-stamped measurement data in internal 'bucket' documents - an optimization that groups documents by time window and metadata. CWE-787 (Out-of-bounds Write) indicates the root cause is a write operation that exceeds the intended memory bounds of an internal data structure. When specific insertion patterns cause inconsistency in the bucket's internal state, a follow-on insert into that same bucket triggers the server to dereference or write to memory outside the allocated region. This is a two-phase vulnerability: a corruption-setup phase followed by a trigger phase. The CPE cpe:2.3:a:mongodb:mongodb_server:*:*:*:*:*:*:*:* covers all versions of MongoDB Server with no version floor or ceiling specified in the available data, suggesting broad version exposure. The Jira tracker reference SERVER-129994 is the primary upstream record.

RemediationAI

No vendor-released patch version has been identified in the available data - the sole reference is the internal MongoDB Jira ticket SERVER-129994, which has not surfaced a confirmed fix version. Monitor https://jira.mongodb.org/browse/SERVER-129994 and MongoDB's official security advisories at https://www.mongodb.com/alerts for patch release details. As immediate compensating controls: restrict write access to timeseries collections to only fully trusted, tightly scoped application service accounts - revoking write privileges from any interactive or lower-trust user eliminates the exploitation prerequisite at the cost of operational flexibility. If timeseries collections are not required by the workload, avoid creating them to remove the attack surface entirely. Network-layer controls such as MongoDB authentication enforcement and restricting database port access to known application hosts reduce the network-reachable attack surface but do not mitigate the flaw for any user with legitimate write credentials.