CVE-2026-18702Medium· 6.4▾ SunlitAn issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings that affect the entire server rather than just the intended database. This could allow suppressio…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
0.2% → 0.3%
An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings that affect the entire server rather than just the intended database. This could allow suppression of diagnostic logging server-wide, potentially obscuring unauthorized activity, or degrade operational monitoring by causing excessive log volume.
mongodb >= 7.0.0, < 7.0.40mongodb >= 8.0.0, < 8.0.29mongodb >= 8.2.0, <= 8.2.12mongodb >= 8.3.0, < 8.3.8mongodb = 9.0.0mongodb = 9.1.0Upgrade past the affected range:
mongodb 8.3.8Connected by shared product, vendor, weakness, or advisory.
CVE-2025-11979Medium· 5.3An authorized user may crash the MongoDB server by causing buffer over-read
CVE-2025-14345Medium· 4.2A post-authentication flaw in the network two-phase commit protocol used for cross-shard transactions in MongoDB Server may lead to logical data inconsistencies under specific conditions which are not predictable and exist for a very sho…
CVE-2025-10060Medium· 6.5MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially causing an invariant failure and server crash during commit
CVE-2026-9737Medium· 6.5During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the meta expression case
CVE-2026-8843Medium· 6.5Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server
CVE-2026-89099High· 7.5A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the same internal memory without synchronization, leading to memory corruption