Which versions of MongoDB Server are affected by EUVD-2026-56912?

MongoDB Server contains a vulnerability allowing any authenticated database user to crash the server, potentially taking mission-critical database services offline.. A patch is available.

How to fix or mitigate EUVD-2026-56912?

Within 24 hours, inventory all MongoDB Server instances in your environment and their current versions, then immediately restrict database user privileges to limit read access to only essential service accounts and roles. Within seven days, implement additional database-level access controls and network segmentation to prevent unauthorized connection attempts, and enable comprehensive query monitoring and logging. Within 30 days, monitor MongoDB security advisories closely and apply the vendor-released patch immediately upon availability; conduct a security review of all database credentials and historical access patterns to identify potential compromised accounts.

MongoDB Server EUVD-2026-56912

Q: What is the CVSS score of EUVD-2026-56912?

EUVD-2026-56912 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-18701 HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-08-11 mongodb

GHSA-m7wq-2pg8-h638

Denial Of Service Memory Corruption MongoDB Mongodb Server

7.1

CVSS 4.0 · Vendor: mongodb

Severity by source

Vendor (mongodb) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

PR:L reflects mandatory authenticated read access; A:H captures complete server process termination; S:U and C:N/I:N because crash is self-contained with no data exposure.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mongodb).

CVSS VectorVendor: mongodb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 11, 2026 - 20:19 EUVD

Analysis Generated

Aug 11, 2026 - 20:14 vuln.today

CVE Published

Aug 11, 2026 - 18:39 cve.org

HIGH 7.1

DescriptionCVE.org

An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause the server process to terminate unexpectedly by submitting a specially formed query filter. This could result in a denial of service.

AnalysisAI

MongoDB Server's query subsystem contains a type confusion flaw (CWE-843) that allows any authenticated user holding read privileges to crash the server process by submitting a specially formed query filter, resulting in a denial of service. The CVSS 4.0 score of 7.1 with VA:H and PR:L reflects the realistic threat: any legitimate database user - including service accounts or compromised low-privilege credentials - can take the database offline with no attack complexity. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low exploitation bar warrants prompt patching once available.

Technical ContextAI

CWE-843 ('Access of Resource Using Incompatible Type,' commonly called type confusion) describes a root cause where software accesses a memory resource using a type incompatible with how it was originally allocated or stored. In MongoDB Server's query subsystem, the flaw manifests when the query planner or filter evaluation engine processes a specially crafted BSON filter document containing type-mismatched field values, triggering memory corruption and an unhandled server crash. The 'Memory Corruption' tag corroborates this mechanism. The CPE string cpe:2.3:a:mongodb:mongodb_server:*:*:*:*:*:*:*:* uses a full wildcard on the version field, indicating no version bounds have been specified in available data - potentially affecting the entire MongoDB Server product line. MongoDB is a document-oriented NoSQL database widely used in enterprise and cloud deployments, making reach significant.

RemediationAI

No vendor-released patched version has been confirmed in the available data at time of analysis; the fix status should be monitored via MongoDB JIRA ticket SERVER-130111 at https://jira.mongodb.org/browse/SERVER-130111. Until a patch is available, the most effective compensating control is to enforce the principle of least privilege: audit all database users and service accounts and revoke read access from any account that does not operationally require it, as exploitation is gated on PR:L authentication. Additionally, restrict network access to MongoDB's default port (27017) at the firewall or network layer to limit the pool of clients that can submit queries - note this may impact legitimate application connectivity and requires coordination with application teams. Enabling MongoDB's built-in auditing to log and alert on anomalous query patterns (particularly deeply nested or malformed BSON filter documents) can aid detection without service disruption. Avoid exposing MongoDB directly to untrusted networks regardless of this specific vulnerability.