CVE-2026-82068

MongoDB Server contains a denial-of-service flaw (CWE-617, reachable assertion) in which an authenticated user holding write privileges can send specially crafted retryable write commands that trigger a fatal assertion crash. The crash state is durably persisted, so the server process crashes again on every restart, and in a sharded cluster the condition can propagate to additional nodes. An attacker gains persistent unavailability of the database service — CVSS 4.0 rates the availability impact high, with no confidentiality or integrity loss — and restoring service requires manual intervention by an operator. Any MongoDB Server deployment that grants write access to not-fully-trusted users (e.g., multi-tenant application users) is potentially affected; the source data does not specify affected version ranges. There is no known public proof-of-concept, the issue is not in CISA KEV, and EPSS estimates only a 0.3% probability of exploitation within 30 days (21st percentile).

What to do: Upgrade MongoDB Server to a patched release as directed by MongoDB's advisory (patched versions were not included in the available data). In the meantime, restrict write privileges to trusted users and limit network access to the database, and monitor for repeated crash-on-restart behavior; in sharded clusters, check whether the persisted crash state has propagated to other nodes, since manual intervention is required to restore availability.