CVE WatchOct 15, 2026

CVE-2026-96299

A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could c

CVSS

6.5

Medium

EPSS

0.2%

p14

KEV

—

Exploit Today

0-100

Published: Oct 13, 2026 · Last modified: Oct 15, 2026 · CWE-617

EPSS · 30d

0.2%EPSS · 30 days0.2%

2026-10-142026-10-22

Technical description

A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregation stage that lacks proper authorization checks despite being intended for internal use, allowing a subsequent stage to be forced to execute on the router under conditions it was not designed to handle. This results in an unhandled fatal error that causes the mongos process to immediately abort, resulting in denial of service for all clients routed through the affected mongos instance.

Official references

jira.mongodb.orghttps://jira.mongodb.org/browse/SERVER-130431

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-764917.5 HIG

17.1%

——5As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.   The vulnerabilities tracked by CVE-2026-76491 are related to issues concerning reachable assertions that are grouped under the Common Weakness Enumeration (CWE) Base CWE-617.20h CVE-2026-1024837.5 HIG

47.0%

——14Reachable exit in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to terminate the daemon via an NTS request with excess NTS Cookie Placeholder extension fields.2d CVE-2026-973137.5 HIG

37.9%

——11A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of "recursive-only yes", and the other with "recursive-only no". This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.2d CVE-2026-968887.5 HIG

39.0%

——12A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.2d CVE-2026-98253.7 LOW

18.1%

——5IBM Cyber Fraud 1.0.0 through 1.0.2 has a missing secure attribute allowing sensitive cookies to be transmitted over unencrypted connections, potentially enabling an attacker to intercept session data through network-based attacks.2d CVE-2026-43853—

35.8%

——11A vulnerability could allow an attacker to send a crafted message to trigger an assertion fault, causing the service to crash.3d