What’s Vulnerable › Vulnerabilities
CVE-2026-9746: Server crashes in case of the use of exchange
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-09 · updated 2026-07-23
- Weakness: CWE-617
Description
When using $changestreams and $_requestReshardingResumeToken with the exchange option the server hits an invariant which causes the server to crash. There are no special privileges needed. The user must be logged in to issue the statement.
Affected products
- MongoDB: from 7.0.0 before 7.0.35; from 8.0.0 before 8.0.24; from 8.2.0 before 8.2.10; from 8.3.0 before 8.3.3 — fixed in 7.0.35, 8.0.24, 8.2.10, 8.3.3
How to fix
Upgrade to a fixed version: MongoDB 7.0.35, 8.0.24, 8.2.10, 8.3.3. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-9746 or the next vulnerability affects your stack