# CERT-FR flags multiple MongoDB Server flaws

Published: 2026-11-12 · Severity: routine · Sectors: Technology · Not tied to an actor or CVE
Canonical: https://vorant.io/reports/b9724ac8-5449-5d79-88da-a11f3ce09ffc/cert-fr-flags-multiple-mongodb-server-flaws
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> CERT-FR warns of multiple vulnerabilities in MongoDB Core Server allowing RCE, data compromise, DoS and CSRF; patches available across all major branches.

Source: cert.cyber.gouv.fr — https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1522

## What to check

- Applies to: Not tied to a specific actor, malware or CVE, only to the sectors it covers, so it may be general reporting. Check the source before acting on it. Whether it concerns you is not assessed.

CERT-FR published an advisory describing multiple vulnerabilities affecting MongoDB Core Server across nearly all supported version branches (4.4.x through 9.1.x). The flaws, tracked internally via a series of MongoDB JIRA SERVER tickets, collectively enable an attacker to achieve arbitrary code execution, compromise data confidentiality and integrity, bypass security policies, cause denial of service, and perform cross-site request forgery (CSRF) attacks against MongoDB deployments.

Affected versions span the full range of actively used releases: 4.4.x before 4.4.32, 5.0.x before 5.0.35, 6.0.x before 6.0.30, 7.0.x before 7.0.48, 8.0.x before 8.0.37, 8.3.x before 8.3.16, 9.0.x before 9.0.7, and 9.1.x before 9.1.0-rc1025. No CVE identifiers are given in this advisory; the underlying technical details are tracked via MongoDB's own JIRA bug-tracking system (SERVER-130169 through SERVER-138119), all dated 10 November 2026. The advisory does not indicate active exploitation in the wild.

Defenders running MongoDB Core Server should prioritize upgrading to the fixed versions referenced for each branch. Given the breadth of affected branches and the severity of possible impacts (including RCE), organizations should treat this as a routine but important patch management action, verifying exposure of MongoDB instances, especially those with network-facing interfaces, and applying vendor-supplied fixes per the referenced JIRA bulletins.

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1522

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/b9724ac8-5449-5d79-88da-a11f3ce09ffc/cert-fr-flags-multiple-mongodb-server-flaws.
The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup