Is CVE-2026-18687 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-18687?

CVE-2026-18687 has a CVSS v3 severity of HIGH (7.1).

Back

CVE-2026-18687

Description

MongoDB Server's handling of a Queryable Encryption maintenance operation did not properly validate certain request parameters against the collection's encrypted field configuration before use. An authenticated user with readWrite privileges could submit a specially formed request that leads to a server crash or excessive internal writes, resulting in resource exhaustion and corruption of encrypted index data.