Vulnerability record
CVE-2026-118383
The short answer
CVE-2026-118383 affects MongoDB MongoDB Server and is rated critical (CVSS 9.5). It is not in CISA's KEV catalog; EPSS puts the chance of exploitation in the next 30 days at 0.71%. The vendor has linked a patch.
What it is
A use-after-free in the replication component of MongoDB Server can occur when a newly elected replica set primary completes catch-up. The condition can be caused by requests that do not require authentication, and may result in the server terminating unexpectedly or, under certain conditions, arbitrary code execution in the context of the server process. Replica set members are affected, including the shard and config server replica set members of sharded clusters; standalone mongod instances are not.
Weakness: CWE-416.
Severity
9.5 critical
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Exploited (CISA KEV)
Not listed
CISA lists confirmed exploitation only
EPSS, next 30 days
0.71%
Higher than 54% of scored CVEs
How it can be exploited
- Attack vector
- Network
- Attack complexity
- High
- Attack requirements
- None
- Privileges required
- None
- User interaction
- None
- Confidentiality impact
- High
- Integrity impact
- High
- Availability impact
- High
Affected products
MongoDB Server. NVD's record lists the exact affected versions.
References
- jira.mongodb.org/browse/SERVER-138119 Issue TrackingPatchVendor Advisory
- jira.mongodb.org/browse/SERVER-138175 Issue TrackingPatchVendor Advisory
Questions
Is CVE-2026-118383 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog as of 2026-11-13. FIRST's EPSS estimates a 0.71% chance of exploitation in the next 30 days.
How do I fix CVE-2026-118383?
Follow the vendor advisory in the references below. NVD lists the affected versions under its configurations.
From NVD, CISA KEV, FIRST EPSS and OSV.dev, checked . Status on NVD: Analyzed. The description is NVD's text, quoted as published.
Related
Know the day a CVE lands in your code
Connect a GitHub repository and ZeusQA checks its dependencies daily, briefs each advisory and opens the fix. Three test runs free, no card.