CVE-2026-18707

MEDIUM

Improper Input Validation in MongoDB Aggregation Command Handling Leads to Denial of Service

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2026-18707 has a selected CVSS score of 5.3 (medium).

Description

An issue in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the server process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 11, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

MongoDB Server

Browse MongoDB / MongoDB Server

Default status: unaffected

CVE List8.3.0 to < 8.3.8affected

References

2