PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9746 MongoDB CVE debrief

CVE-2026-9746 is a HIGH severity vulnerability in MongoDB that causes the server to crash when using $changestreams and $_requestReshardingResumeToken with the exchange option. The user must be logged in to issue the statement, but no special privileges are needed. The vulnerability has a CVSS score of 7.1.

Vendor
MongoDB
Product
MongoDB Server
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-09
Original CVE updated
2026-06-18
Advisory published
2026-06-09
Advisory updated
2026-06-18

Who should care

Users of MongoDB who use $changestreams and $_requestReshardingResumeToken with the exchange option should be aware of this vulnerability and take steps to mitigate it.

Technical summary

The vulnerability occurs when the server hits an invariant, causing it to crash. The vulnerability is triggered by a specific sequence of operations involving $changestreams and $_requestReshardingResumeToken with the exchange option.

Defensive priority

HIGH

Recommended defensive actions

  • Apply the patch or update to the latest version of MongoDB as soon as possible.
  • Review and restrict the use of $changestreams and $_requestReshardingResumeToken with the exchange option.
  • Monitor MongoDB server logs for signs of crashes or errors.

Evidence notes

The CVE record was obtained from the official CVE website and the NVD detail page.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-9746 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-9746

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-9746 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9746

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.