BIT-mongodb-2026-9746

vendorUSosv

Server crashes in case of the use of exchange

view advisory published 2026-06-22Licence: per source

When using $changestreams and $_requestReshardingResumeToken with the exchange option the server hits an invariant which causes the server to crash. There are no special privileges needed. The user must be logged in to issue the statement.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-9746US	—	0.27% (19th)	—	2026-06-09
When using $changestreams and $_requestReshardingResumeToken with the exchange option the server hits an invariant which causes the server to crash. There are no special privileges…

references

External citations — patches, advisories, analysis.

https://jira.mongodb.org/browse/SERVER-124190ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2026-9746WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan