Which versions of MongoDB Server are affected by CVE-2026-9737?

MongoDB Server is affected by CVE-2026-9737, a high-severity vulnerability that allows database users to crash the server through specially-crafted query requests.. A patch is available.

How to fix or mitigate CVE-2026-9737?

Within 24 hours: identify all MongoDB Server deployments in production, confirm which versions are affected by CVE-2026-9737, and audit user permissions to understand who can submit queries to the database. Within 7 days: implement role-based access control restricting query submission to trusted application service accounts only, enable MongoDB's query audit logging to detect suspicious patterns, and configure automated database monitoring with automatic restart on process failure. Within 30 days: monitor MongoDB's security advisories for patch availability and validate patches in non-production environments before deployment; establish escalation procedures for database crashes and document compensating controls.

MongoDB Server CVE-2026-9737

Q: What is the CVSS score of CVE-2026-9737?

CVE-2026-9737 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-47775 HIGH

Reachable Assertion (CWE-617)

2026-07-22 cna@mongodb.com

Information Disclosure

7.1

CVSS 4.0 · Vendor: mongodb

Severity by source

Vendor (mongodb) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Authenticated user needs only query privileges (PR:L) to send a crafted sort over the network (AV:N/AC:L); impact is a process crash, so A:H with C:N/I:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mongodb).

CVSS VectorVendor: mongodb

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 22, 2026 - 21:03 EUVD

Analysis Generated

Jul 22, 2026 - 20:38 vuln.today

CVE Published

Jul 22, 2026 - 20:17 cve.org

HIGH 7.1

DescriptionCVE.org

During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the meta expression case. This may lead to incorrect transformations leading to invariant failure.

AnalysisAI

Denial of service in MongoDB Server allows an authenticated user to crash the database process by submitting a query whose sort specification embeds a $meta expression in raw BSONObj form. Because query planning fails to explicitly handle the meta-expression case when reading the sort pattern, it performs an incorrect transformation that trips an internal invariant, terminating the mongod process. No public exploit identified at time of analysis; the issue is tracked in MongoDB's Jira as SERVER-128341 and reported by MongoDB's own CNA.

Technical ContextAI

The flaw lives in MongoDB's query planner, specifically the code path that parses the sort pattern (the ordering specification of a find/aggregate query) directly from its raw BSON representation. MongoDB supports $meta-based sort keys (e.g. sorting by textScore or searchScore), which are not ordinary field-path sort components. In several planner locations this meta-expression variant is not explicitly handled, so a raw-BSON sort containing $meta is transformed as if it were a normal key, producing an inconsistent internal state. This is a textbook CWE-617 (Reachable Assertion / invariant failure): rather than corrupting data, the inconsistency is caught by a runtime invariant() check that intentionally aborts the process. The affected component is the server-side query engine (mongod), not the drivers or client tooling.

RemediationAI

Patch status: Patch available per vendor advisory - upgrade to the fixed MongoDB Server release identified in Jira SERVER-128341 (https://jira.mongodb.org/browse/SERVER-128341); the exact patched version numbers were not included in the provided data and should be read directly from that ticket before scheduling the upgrade. As compensating controls until patching, restrict who can issue ad-hoc queries by tightening role-based access control so that only trusted application service accounts hold find/aggregate privileges (trade-off: does not protect against a compromised or malicious application account), and deploy MongoDB as a replica set so an invariant-triggered crash causes automatic failover rather than a full outage (trade-off: reduces downtime but does not prevent repeated crashing of primaries by a persistent attacker). Where feasible, review application code to ensure $meta sort expressions are only constructed server-side from trusted input, since the trigger is a specific sort-pattern shape.