Multiple vulnerabilities in MongoDB Server (October 14, 2026)

CERT-FR Advisory Subject: Multiple vulnerabilities in MongoDB Server Document management A detailed version history is at the end of this document. Risks - Remote Denial of Service - Remote Arbitrary Code Execution Affected systems - Server versions 7.x prior to 7.0.45 - Server versions 8.0.x prior to 8.0.34 - Server versions 8.3.x prior to 8.3.13 - Server versions 9.0.x prior to 9.0.0-rc2 - Server versions 9.1.x prior to 9.1.0-rc1024 Summary Multiple vulnerabilities have been discovered in MongoDB Server. They allow an attacker to cause remote arbitrary code execution and remote denial of service. Solutions Refer to the vendor's security bulletin for patches (see Documentation section). Documentation - MongoDB SERVER Security Bulletin-130431 dated October 13, 2026 https://jira.mongodb.org/browse/SERVER-130431 - MongoDB SERVER Security Bulletin-131411 dated October 13, 2026 https://jira.mongodb.org/browse/SERVER-131411 - MongoDB SERVER Security Bulletin-131412 dated October 13, 2026 https://jira.mongodb.org/browse/SERVER-131412 - MongoDB SERVER Security Bulletin-132946 dated October 13, 2026 https://jira.mongodb.org/browse/SERVER-132946 - MongoDB SERVER Security Bulletin-134618 dated October 13, 2026 https://jira.mongodb.org/browse/SERVER-134618 - CVE Reference CVE-2026-103965 https://www.cve.org/CVERecord?id=CVE-2026-103965 - CVE Reference CVE-2026-104004 https://www.cve.org/CVERecord?id=CVE-2026-104004 - CVE Reference CVE-2026-104005 https://www.cve.org/CVERecord?id=CVE-2026-104005 - CVE Reference CVE-2026-96297 https://www.cve.org/CVERecord?id=CVE-2026-96297 - CVE Reference CVE-2026-96299 https://www.cve.org/CVERecord?id=CVE-2026-96299