What is CVE-2026-18708?

CVE-2026-18708 is a medium-severity vulnerability in Mongodb Server, classified under Code Injection. CVSS score: 6.4/10. Published 2026-08-11.

How severe is CVE-2026-18708?

Medium severity. CVSS v3 base score is 6.4 out of 10.

RCE in Mongodb Server

CVE-2026-18708

An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to cause code they control to be executed within the query scope of other users, through a specially crafted stored value proc…

Vulnerability class: RCE (Remote Code Execution)

CVSS v3 metric

CVSS v3 base score 6.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L.

Affected products

Mongodb Server — versions 8.3.0, 8.0, 7.0

Weakness classification (CWE)

CWE-94 — Code Injection

References

cna@mongodb.com

Frequently asked questions

What is CVE-2026-18708?: CVE-2026-18708 is a medium-severity vulnerability in Mongodb Server, classified under Code Injection. CVSS score: 6.4/10. Published 2026-08-11.
How severe is CVE-2026-18708?: Medium severity. CVSS v3 base score is 6.4 out of 10.