# CERT-FR Flags Five MongoDB Server CVEs

Published: 2026-10-14 · Severity: routine · Sectors: technology
Canonical: https://vorant.io/reports/8a05513a-e950-5197-92c9-970603d10fa7/cert-fr-flags-five-mongodb-server-cves

> CERT-FR advisory details multiple MongoDB Server vulnerabilities allowing remote code execution and denial of service; patches available.

CERT-FR published an advisory covering five vulnerabilities in MongoDB Server affecting versions 7.x prior to 7.0.45, 8.0.x prior to 8.0.34, 8.3.x prior to 8.3.13, 9.0.x prior to 9.0.0-rc2, and 9.1.x prior to 9.1.0-rc1024. The flaws, tracked as CVE-2026-103965, CVE-2026-104004, CVE-2026-104005, CVE-2026-96297, and CVE-2026-96299, allow a remote attacker to achieve arbitrary code execution and/or cause denial of service against affected MongoDB Server instances.

No evidence of active exploitation is mentioned in the advisory. CERT-FR directs administrators to MongoDB's own security bulletins (referenced via JIRA tickets SERVER-130431, SERVER-131411, SERVER-131412, SERVER-132946, and SERVER-134618) for patch details. Defenders running MongoDB Server should prioritize upgrading to the fixed versions noted above, particularly on internet-facing or production database instances, given the potential for remote code execution.

## Mentioned in this report

- Vulnerabilities: CVE-2026-103965, CVE-2026-104004, CVE-2026-104005, CVE-2026-96297, CVE-2026-96299

## Detection guidance (public sample)

### MongoDB Server Process Spawning Shell or Download Utility on Linux

ATT&CK: T1190

mongod spawning a shell, interpreter or download/netcat tool, a likely post-exploitation sign of remote code execution in MongoDB Server. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: MongoDB Server Process Spawning Shell or Download Utility on Linux
description: Detects the mongod daemon spawning a shell, scripting interpreter or
  download/netcat utility. The CERT-FR advisory describes remote code execution in
  MongoDB Server, and a database daemon should almost never create these child processes.
  This is a generic post-exploitation detection, not a CVE-specific signature, and
  no active exploitation has been reported.
tags:
- attack.initial-access
- attack.execution
- attack.t1190
- attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
    - /mongod
    - /mongos
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /zsh
    - /python
    - /python3
    - /perl
    - /nc
    - /ncat
    - /curl
    - /wget
  condition: selection
falsepositives:
- Administrators running custom maintenance or backup scripts launched directly by
  mongod wrappers
- Container entrypoint scripts where the shell is the parent and mongod is later re-executed
level: high
id: 96813c04-dd0f-5194-b820-5b1ed56ecc11
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1304
```

### MongoDB Server Process Spawning Command Interpreter on Windows

ATT&CK: T1190

mongod.exe or mongos.exe spawning cmd, PowerShell, script hosts or LOLBin downloaders, a likely post-exploitation sign of RCE in MongoDB Server. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: MongoDB Server Process Spawning Command Interpreter on Windows
description: Detects mongod.exe or mongos.exe spawning a command interpreter, script
  host or common download LOLBin. The CERT-FR advisory describes remote code execution
  in MongoDB Server, and a database service has little legitimate reason to start
  these child processes. This is a generic post-exploitation detection, not a CVE-specific
  signature.
tags:
- attack.initial-access
- attack.execution
- attack.t1190
- attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \mongod.exe
    - \mongos.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \curl.exe
  condition: selection
falsepositives:
- Custom administrative tooling that launches scripts from the mongod service account
level: high
id: 8c6b2635-d95a-5fcd-9aef-d0ddf155848f
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1304
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1304

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/8a05513a-e950-5197-92c9-970603d10fa7/cert-fr-flags-five-mongodb-server-cves.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup