MongoDB has released security updates covering 25 vulnerabilities across its database server and one of its official drivers, and anyone running a self-managed deployment should check their build numbers now.
The fixes come from MongoDB itself, published on the company's product security alerts page. Hong Kong's HKCERT relayed them in a security bulletin dated 13 August 2026, rating the set as medium risk. MongoDB's own product security alerts page remains the authoritative source for per-issue detail.
What's affected
Four release lines need attention:
- MongoDB Server 7.0.0 up to (but not including) 7.0.40
- MongoDB Server 8.0.0 up to (but not including) 8.0.29
- MongoDB Server 8.3.0 up to (but not including) 8.3.8
- MongoDB Driver 4.11.0 up to (but not including) 5.9.2, listed in the bulletin only as "MongoDB Driver" without naming a specific language binding
The 25 identifiers run between CVE-2026-18687 and CVE-2026-18712.
What is, and is not, known
The bulletin says a remote attacker could exploit some of these vulnerabilities to trigger denial of service, information disclosure, remote code execution, security restriction bypass, elevation of privilege and data manipulation. That is an aggregate list describing the whole set, not any single issue.
Beyond that, the published material is thin, and it is worth being straightforward about the gaps. No CVSS score is published for any of the 25 identifiers, so there is no public basis for ranking one above another. Neither the bulletin nor the relayed vendor summary explains how any individual flaw works, what access or preconditions an attacker would need to reach it, or which of the listed impacts belongs to which identifier. There is also no indication that any of them has been exploited. MongoDB's advisories carry whatever detail exists; treat any account that goes further than the above as speculation until it does.
What you should do
Move to 7.0.40, 8.0.29 or 8.3.8 depending on which server line you run, and to 5.9.2 for the affected driver. Fully managed deployments such as MongoDB Atlas are patched by the provider, so the exposure that matters here is self-managed clusters and applications pinned to an older driver release. Since a database server should rarely be reachable from the open internet in the first place, this is a reasonable moment to confirm that yours is not.
Data infrastructure has drawn steady attention this month. Attackers have been actively exploiting a SQL injection flaw in the Metabase business intelligence dashboard, and separate research found one-click hosting templates exposing databases with a default password. Neither is connected to these MongoDB fixes, but both point at the same soft spot: data stores that end up reachable and out of date.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.