CVE-2026-82064

MongoDB Server contains a reachable assertion (CWE-617) in its read concern processing logic that can be invoked by an unauthenticated network user. The assertion's assumptions about internal state do not hold for a specific type of replica set member, so a crafted unauthenticated request causes the server process to terminate. An attacker gains denial of service only: the affected mongod process crashes, degrading replica set availability, with no confidentiality or integrity impact (CVSS 4.0 availability impact: High). Affected systems are MongoDB Server deployments running the specified replica set member configuration; the available data does not name the affected or fixed version ranges. No public proof-of-concept, no CISA KEV listing, and a low EPSS (0.3%) indicate no known exploitation at this time.

What to do: Watch MongoDB's official advisory for CVE-2026-82064 and upgrade to the fixed release it names (not specified in the data available here), prioritizing replica sets that include the affected member type. Until patching, reduce exposure by binding mongod to trusted interfaces and blocking port 27017 from untrusted networks, since the crash path requires no authentication. No exploit or in-the-wild activity is known, so routine patch-cycle remediation is reasonable for non-exposed clusters.