First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-18697

HighCVSS 7.5/10Last modified Oct 23, 2026

Description

An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (router) process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service, disrupting client connections routed through the affected mongos instance.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
MongoDB	MongoDB Server	>= 8.3.0, < 8.3.8; >= 8.0, < 8.0.29; >= 7.0, < 7.0.40

References

https://jira.mongodb.org/browse/SERVER-130110Vendor Advisory, Issue Tracking

Timeline

Published: Aug 11, 2026
Last modified: Oct 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-186985.4An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected syst CVE-2026-186996.5An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the server process to termi CVE-2026-18705.3The Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor plugin for WordPress is vulnerable to unauthorized access of data d CVE-2026-187006.5An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an internal reference to CVE-2026-187016.5An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause the server process to terminate CVE-2026-187026.4An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings CVE-2026-187034.2An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authenticate using a cert CVE-2026-187046.5An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations a CVE-2026-187056.5An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view to retrieve document CVE-2026-187066.6An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue aggregation and memory-managemen CVE-2026-187074.3An issue in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the server process to term CVE-2026-187086.4An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to cause code they control

CVE-2026-18697: High severity, CVSS 7.5 | Vulnix