Skip to content
Threat Feed
Subscribe
low advisory

Multiple Vulnerabilities in MongoDB Server

Multiple vulnerabilities, including CVE-2026-103965, CVE-2026-104004, CVE-2026-104005, CVE-2026-96297, and CVE-2026-96299, in MongoDB Server allow remote attackers to achieve arbitrary code execution or denial of service.

CVE search metadata

CVE search record: CVE-2026-103965. Severity: medium. CVSS: 5.4. KEV: no. Product: MongoDB Server (versions < 7.0.45), MongoDB Server (versions < 8.0.34), MongoDB Server (versions < 8.3.13), MongoDB Server (versions < 9.0.0-rc2), MongoDB Server (versions < 9.1.0-rc1024). Brief: Multiple Vulnerabilities in MongoDB Server. Brief link: https://feed.craftedsignal.io/briefs/2026-10-mongodb-vulnerabilities/

CVE search record: CVE-2026-104004. Severity: medium. CVSS: 6.5. KEV: no. Product: MongoDB Server (versions < 7.0.45), MongoDB Server (versions < 8.0.34), MongoDB Server (versions < 8.3.13), MongoDB Server (versions < 9.0.0-rc2), MongoDB Server (versions < 9.1.0-rc1024). Brief: Multiple Vulnerabilities in MongoDB Server. Brief link: https://feed.craftedsignal.io/briefs/2026-10-mongodb-vulnerabilities/

CVE search record: CVE-2026-104005. Severity: medium. CVSS: 6.5. KEV: no. Product: MongoDB Server (versions < 7.0.45), MongoDB Server (versions < 8.0.34), MongoDB Server (versions < 8.3.13), MongoDB Server (versions < 9.0.0-rc2), MongoDB Server (versions < 9.1.0-rc1024). Brief: Multiple Vulnerabilities in MongoDB Server. Brief link: https://feed.craftedsignal.io/briefs/2026-10-mongodb-vulnerabilities/

CVE search record: CVE-2026-96297. Severity: medium. CVSS: 6.5. KEV: no. Product: MongoDB Server (versions < 7.0.45), MongoDB Server (versions < 8.0.34), MongoDB Server (versions < 8.3.13), MongoDB Server (versions < 9.0.0-rc2), MongoDB Server (versions < 9.1.0-rc1024). Brief: Multiple Vulnerabilities in MongoDB Server. Brief link: https://feed.craftedsignal.io/briefs/2026-10-mongodb-vulnerabilities/

CVE search record: CVE-2026-96299. Severity: medium. CVSS: 6.5. KEV: no. Product: MongoDB Server (versions < 7.0.45), MongoDB Server (versions < 8.0.34), MongoDB Server (versions < 8.3.13), MongoDB Server (versions < 9.0.0-rc2), MongoDB Server (versions < 9.1.0-rc1024). Brief: Multiple Vulnerabilities in MongoDB Server. Brief link: https://feed.craftedsignal.io/briefs/2026-10-mongodb-vulnerabilities/

The French National Cybersecurity Agency (ANSSI) has reported multiple vulnerabilities affecting various branches of MongoDB Server. These vulnerabilities, identified as CVE-2026-103965, CVE-2026-104004, CVE-2026-104005, CVE-2026-96297, and CVE-2026-96299, present significant security risks, including the potential for remote arbitrary code execution (RCE) and denial of service (DoS). The affected versions include MongoDB Server 7.x prior to 7.0.45, 8.0.x prior to 8.0.34, 8.3.x prior to 8.3.13, 9.0.x prior to 9.0.0-rc2, and 9.1.x prior to 9.1.0-rc1024. Organizations using these versions are encouraged to audit their database deployments and apply the security patches provided by MongoDB as soon as possible to mitigate the risk of exploitation.

Impact

Successful exploitation of these vulnerabilities could result in a complete system compromise via remote arbitrary code execution or service disruption through denial of service. The scope of impact includes any infrastructure running the vulnerable MongoDB Server versions, potentially leading to unauthorized data access, system takeover, or operational downtime across business-critical database environments.

Recommendation

  • Upgrade all affected MongoDB Server instances to the patched versions specified in the vendor's security bulletins (SERVER-130431, SERVER-131411, SERVER-131412, SERVER-132946, SERVER-134618).
  • Review the official MongoDB JIRA project documentation linked in the references for detailed remediation steps for each identified CVE.
  • Restrict network access to MongoDB instances to authorized clients only to minimize the attack surface while update procedures are scheduled.

Immediate actions

Upgrade MongoDB Server to 7.0.45 or later

IT Operations 72h

Mitigations

Apply patches provided in MongoDB security bulletins SERVER-130431, SERVER-131411, SERVER-131412, SERVER-132946, and SERVER-134618.

immediate IT Operations

CVE-2026-103965, CVE-2026-104004, CVE-2026-104005, CVE-2026-96297, CVE-2026-96299