1. Home
  2. CVE Database
  3. CVE-2026-18692
HIGH · 8.8

CVE-2026-18692

An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has b...

Vulnerability Description

An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed. Subsequent operations could then result in a server crash or, potentially, execution of unintended code.

CVSS Score

8.8

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
MongodbMongodb>= 8.0.0, < 8.0.29

Related Weaknesses (CWE)

CWE-416

References

FAQ

What is CVE-2026-18692?

CVE-2026-18692 is a vulnerability with a CVSS score of 8.8 (HIGH). An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has b...

How severe is CVE-2026-18692?

CVE-2026-18692 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-18692?

Check the references section above for vendor advisories and patch information. Affected products include: Mongodb Mongodb.