CVE-2026-18693
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A vulnerability in MongoDB Server's handling of timeseries collections allows an authenticated user with write privileges to cause internal data structure inconsistency through specific document insertions. Subsequent inserts into the affected bucket can lead to out-of-bounds memory access, potentially causing a server crash, memory exposure, or memory corruption.
Risk Assessment
The risk includes denial of service, potential memory disclosure, and memory corruption, which could lead to unpredictable system behavior.
Recommendation
Update MongoDB Server to a patched version and monitor write access to timeseries collections.
Original NVD description (English source)
An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges to cause an internal data structure to become inconsistent through certain document insertions. A subsequent insert into the affected bucket could then result in the server accessing memory outside its intended bounds, potentially causing a server crash (denial of service), exposure of limited memory contents, or memory corruption.