CVE-2026-118383
Not in KEVNo confirmed exploitation in CISA's catalog yet
What happened
A critical unauthenticated vulnerability in MongoDB Server (CVE-2026-118383) allows attackers to send two requests that crash the database when it is elected to become the primary server during replica set failover. MongoDB has released patches. Administrators should apply fixes promptly to prevent denial of service attacks targeting replica set infrastructure.
From the Intel60 brief of Nov 12, 2026. AI-written summary: check the sources before acting.
Intel60 briefs
- CriticalMongoDB pre-auth flaw crashes servers on failoverNov 12, 2026