Which versions of MongoDB Server are affected by EUVD-2026-35866?

MongoDB Server (CVE-2026-9750) allows any authenticated user-including low-privilege application accounts-to crash the database or obtain corrupted query results, creating availability and data…. A patch is available.

How to fix or mitigate EUVD-2026-35866?

24 hours: Audit MongoDB user accounts and restrict write privileges to only essential application identities; enable operation logging. 7 days: Deploy role-based access controls limiting write permissions; configure alerts for mongod process crashes and unusual query patterns. 30 days: Monitor MongoDB security advisories for patch availability; plan and execute upgrades to patched versions when released.

MongoDB Server EUVD-2026-35866

Q: What is the CVSS score of EUVD-2026-35866?

EUVD-2026-35866 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-9750 HIGH

Reachable Assertion (CWE-617)

2026-06-09 mongodb

GHSA-qh22-j9ch-4x4c

Denial Of Service MongoDB Mongodb Server

7.1

CVSS 4.0 · Vendor: mongodb

Severity by source

Vendor (mongodb) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (mongodb) · only source for this CVE.

CVSS VectorVendor: mongodb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 10, 2026 - 02:01 EUVD

Analysis Generated

Jun 09, 2026 - 23:23 vuln.today

Severity Changed

Jun 09, 2026 - 23:22 NVD

MEDIUM HIGH

CVSS changed

Jun 09, 2026 - 23:22 NVD

6.5 (MEDIUM) 7.1 (HIGH)

DescriptionCVE.org

An authenticated user can cause a MongoDB server to crash or return incorrect results by creating documents that interfere with internal metadata processing during query execution. This stems from insufficient separation between user-controlled document fields and internal metadata in certain execution paths.

AnalysisAI

MongoDB Server exposes an availability and data integrity risk allowing any low-privileged authenticated user to crash the mongod process or obtain incorrect query results by inserting specially crafted documents. The root cause - insufficient separation between user-controlled document fields and internal execution metadata (CWE-617: Reachable Assertion) - means the attack surface is the normal document write workflow, requiring no elevated roles. CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) is consistent with this profile: network-reachable, low complexity, low-privilege; no public exploit or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

MongoDB Server is a document-oriented NoSQL database that stores and queries BSON (Binary JSON) documents. During query execution, the server maintains internal metadata structures - such as query plan cache entries, execution stage descriptors, and field path trackers - that are separate from user data. CWE-617 (Reachable Assertion) indicates that crafted document field names or structures can reach a code path that contains an internal assertion or invariant check, triggering an unhandled assertion failure that causes the mongod process to terminate or produce corrupted intermediate results. The CPE string cpe:2.3:a:mongodb:mongodb_server:*:*:*:*:*:*:*:* uses a full wildcard version range, meaning the NVD has not yet bounded the affected version scope to specific releases. The referenced JIRA ticket SERVER-123633 (https://jira.mongodb.org/browse/SERVER-123633) is the canonical upstream tracking issue and likely contains patch commit or fix-version information not yet reflected in public metadata.

RemediationAI

No vendor-released patch version has been confirmed from available data - the sole reference is the MongoDB JIRA ticket SERVER-123633 at https://jira.mongodb.org/browse/SERVER-123633, which should be monitored for a fix-version announcement. Until a patch is available, restrict document INSERT and CREATE privileges to only explicitly trusted application service accounts; removing write access from broadly-scoped or shared credentials directly eliminates the ability to deliver the malicious document payload, though this may require application-level refactoring. Enforce strict server-side schema validation rules (using MongoDB's built-in JSON Schema validator) to reject documents with unexpected or suspicious field naming patterns before they reach the vulnerable execution paths - note this adds query latency on write operations. Monitor mongod process logs for unexpected assertion failures or crashes (SIGABRT, invariant violations) as indicators of exploitation attempts. Subscribe to MongoDB security advisories at https://www.mongodb.com/alerts to receive notification when a patched release is published.