CVE-2026-18693

Awaiting Analysis Awaiting Analysis - Queue

Memory Corruption in MongoDB Server Timeseries Collections

Publication date: 2026-08-11

Last updated on: 2026-08-28

Assigner: MongoDB, Inc.

Description

An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges to cause an internal data structure to become inconsistent through certain document insertions. A subsequent insert into the affected bucket could then result in the server accessing memory outside its intended bounds, potentially causing a server crash (denial of service), exposure of limited memory contents, or memory corruption.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-28

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-18693

EUVD

EUVD-2026-56909

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	mongodb_server	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability affects MongoDB Server's handling of timeseries collections. An authenticated user with write privileges can cause an internal data structure to become inconsistent by inserting certain documents. This may lead to memory access outside intended bounds during subsequent inserts, potentially causing a server crash, limited memory exposure, or memory corruption.

Detection Guidance

This vulnerability requires authenticated access with write privileges to MongoDB timeseries collections. Detection involves monitoring for unusual document insertions or crashes in MongoDB Server. Check MongoDB logs for errors related to timeseries collections or memory access violations. Ensure your MongoDB version is updated to the latest patched version.

Impact Analysis

If exploited, this vulnerability could disrupt database operations by crashing the server (denial of service). It may also expose limited memory contents or corrupt memory, potentially affecting data integrity or confidentiality for users with write access to timeseries collections.

Compliance Impact

This vulnerability could lead to exposure of limited memory contents or memory corruption, which may result in unauthorized data access. This could violate GDPR's data protection principles or HIPAA's confidentiality requirements if sensitive data is compromised.

Mitigation Strategies

Immediately update MongoDB Server to the latest patched version to address the issue. Restrict write privileges to trusted users only. Monitor MongoDB logs for suspicious activity or crashes. Consider disabling timeseries collections if not in use until patched.

Hi! I’m here to help you understand CVE-2026-18693. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70