CERT-FR Flags Five MongoDB Server CVEs
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CERT-FR advisory details multiple MongoDB Server vulnerabilities allowing remote code execution and denial of service; patches available.
CERT-FR published an advisory covering five vulnerabilities in MongoDB Server affecting versions 7.x prior to 7.0.45, 8.0.x prior to 8.0.34, 8.3.x prior to 8.3.13, 9.0.x prior to 9.0.0-rc2, and 9.1.x prior to 9.1.0-rc1024. The flaws, tracked as CVE-2026-103965, CVE-2026-104004, CVE-2026-104005, CVE-2026-96297, and CVE-2026-96299, allow a remote attacker to achieve arbitrary code execution and/or cause denial of service against affected MongoDB Server instances.
No evidence of active exploitation is mentioned in the advisory. CERT-FR directs administrators to MongoDB's own security bulletins (referenced via JIRA tickets SERVER-130431, SERVER-131411, SERVER-131412, SERVER-132946, and SERVER-134618) for patch details. Defenders running MongoDB Server should prioritize upgrading to the fixed versions noted above, particularly on internet-facing or production database instances, given the potential for remote code execution.
Mentioned in this report
Detection guidance
MongoDB Server Process Spawning Shell or Download Utility on Linux
mongod spawning a shell, interpreter or download/netcat tool, a likely post-exploitation sign of remote code execution in MongoDB Server. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: MongoDB Server Process Spawning Shell or Download Utility on Linux
description: Detects the mongod daemon spawning a shell, scripting interpreter or
download/netcat utility. The CERT-FR advisory describes remote code execution in
MongoDB Server, and a database daemon should almost never create these child processes.
This is a generic post-exploitation detection, not a CVE-specific signature, and
no active exploitation has been reported.
tags:
- attack.initial-access
- attack.execution
- attack.t1190
- attack.t1059.004
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /mongod
- /mongos
Image|endswith:
- /sh
- /bash
- /dash
- /zsh
- /python
- /python3
- /perl
- /nc
- /ncat
- /curl
- /wget
condition: selection
falsepositives:
- Administrators running custom maintenance or backup scripts launched directly by
mongod wrappers
- Container entrypoint scripts where the shell is the parent and mongod is later re-executed
level: high
id: 96813c04-dd0f-5194-b820-5b1ed56ecc11
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1304
MongoDB Server Process Spawning Command Interpreter on Windows
mongod.exe or mongos.exe spawning cmd, PowerShell, script hosts or LOLBin downloaders, a likely post-exploitation sign of RCE in MongoDB Server. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: MongoDB Server Process Spawning Command Interpreter on Windows
description: Detects mongod.exe or mongos.exe spawning a command interpreter, script
host or common download LOLBin. The CERT-FR advisory describes remote code execution
in MongoDB Server, and a database service has little legitimate reason to start
these child processes. This is a generic post-exploitation detection, not a CVE-specific
signature.
tags:
- attack.initial-access
- attack.execution
- attack.t1190
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \mongod.exe
- \mongos.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \certutil.exe
- \bitsadmin.exe
- \curl.exe
condition: selection
falsepositives:
- Custom administrative tooling that launches scripts from the mongod service account
level: high
id: 8c6b2635-d95a-5fcd-9aef-d0ddf155848f
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1304
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1304
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs