CVE-2026-18697

HIGH

Improper Input Validation in MongoDB Aggregation Framework Allows Unauthenticated Denial of Service on mongos

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2026-18697 has a selected CVSS score of 8.7 (high).

Description

An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (router) process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service, disrupting client connections routed through the affected mongos instance.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 11, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

MongoDB Server

Browse MongoDB / MongoDB Server

Default status: unaffected

CVE List8.3.0 to < 8.3.8affected
8.0 to < 8.0.29affected
7.0 to < 7.0.40affected

References

2