CVE-2026-18693

HighCVSS 7.6/10Last modified Oct 23, 2026

Description

An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges to cause an internal data structure to become inconsistent through certain document insertions. A subsequent insert into the affected bucket could then result in the server accessing memory outside its intended bounds, potentially causing a server crash (denial of service), exposure of limited memory contents, or memory corruption.

Metrics

CVSS 3.1 7.6/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

Weakness enumeration

CWE-787

Affected software

VendorProductVersions
MongoDBMongoDB Server>= 8.3.0, < 8.3.8; >= 8.0, < 8.0.29; >= 7.0, < 7.0.40

References

Timeline

Published
Aug 11, 2026
Last modified
Oct 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-186947.1An issue in MongoDB Server's geospatial query processing could allow an authenticated user with write privileges to cause certain malformed CVE-2026-186956.5An issue in MongoDB Server's handling of certain query predicates against time-series collections with a metaField could allow an authenticaCVE-2026-186966.5An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-default privileges to perform certain dataCVE-2026-186977.5An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (router) process to terminate unexCVE-2026-186985.4An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected systCVE-2026-186996.5An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the server process to termiCVE-2026-18705.3The Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor plugin for WordPress is vulnerable to unauthorized access of data dCVE-2026-187006.5An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an internal reference toCVE-2026-187016.5An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause the server process to terminateCVE-2026-187026.4An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings CVE-2026-187034.2An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authenticate using a certCVE-2026-187046.5An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations a
CVE-2026-18693: High severity, CVSS 7.6 | Vulnix