MONGODB has released patches addressing 24 server vulnerabilities across its recent releases, with six CVEs highlighted in the report. The most severe issue is CVE-2026-82067, rated 9.2 (CVSSv4), described as improper case sensitivity in configuration validation that can leave the authorization system disabled at startup, potentially allowing an unauthenticated network user to perform admin operations.
The remaining notable flaws carry high severity, including CVE-2026-82075 (unauthenticated denial of service via resource exhaustion in the Sharded Cluster Router) and CVE-2026-82064 (unauthenticated denial of service via assertion failure in read concern processing on replica set members). The article notes that, at the time of reporting, none of the flaws had confirmed in‑the‑wild exploitation.
Affected MongoDB server versions span 7.0.0 through 8.3.x, with fixes landed in three release lines: 8.3.9, 8.0.30, and 7.0.41. In practice, administrators are urged to upgrade immediately to the corresponding fixed releases for their line and to restrict network access to database and router ports. The guidance also emphasises reviewing user privileges and dropping unused accounts, as well as validating that authorization remains enabled after each restart.
The article states that there has been no public proof‑of‑concept or active exploitation reported to date. Overall, the patches close critical auth bypass and several unauthenticated crashes, underscoring the need for timely updates.