CVE-2026-18707
published 2026-08-11CVE-2026-18707: An issue in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the server process to terminate unexpectedly…
PriorityP419medium4.3CVSS 3.1
AVNACLPRLUINSUCNINAL
EPSS
0.26%
16.3th percentile
An issue in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the server process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mongodb | mongodb | — | — |
| mongodb | mongodb | — | — |
| mongodb | mongodb | — | — |
| mongodb | mongodb | >= 7.0.0 < 7.0.40 | 7.0.40 |
| mongodb | mongodb | >= 8.0.0 < 8.0.29 | 8.0.29 |
| mongodb | mongodb | 8.2.0 – 8.2.12 | — |
| mongodb | mongodb | >= 8.3.0 < 8.3.8 | 8.3.8 |
| mongodb | mongodb_server | >= 8.3.0 < 8.3.8 | 8.3.8 |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
nvdv4.05.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
MongoDB up to 8.3.7 Aggregation input validation (Nessus ID 343459)
vuldb·2026-09-08·CVSS 4.3
CVE-2026-18707 [MEDIUM] MongoDB up to 8.3.7 Aggregation input validation (Nessus ID 343459)
A vulnerability marked as problematic has been reported in MongoDB up to 8.3.7. The affected element is an unknown function of the component Aggregation. The manipulation leads to improper input validation.
This vulnerability is uniquely identified as CVE-2026-18707. The attack is possible to be carried out remotely. No exploit exists.
It is suggested to upgrade the affected component.
GHSA
An issue in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the server process to terminate unexpectedly by submitting a specially formed aggregat
ghsa_unreviewed·2026-08-11
CVE-2026-18707 [MEDIUM] CWE-617 An issue in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the server process to terminate unexpectedly by submitting a specially formed aggregat
An issue in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the server process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-08-11
Published