How severe is CVE-2026-9754?

CVE-2026-9754 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2026-9754 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (30th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-9754?

CVE-2026-9754 affects Mongodb. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-9754?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-9754 have an EU (EUVD) identifier?

Yes. CVE-2026-9754 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-35853.

When was CVE-2026-9754 published?

CVE-2026-9754 was published on 2026-06-09 and last updated on 2026-07-23.

CVE-2026-9754

CVE-2026-9754 is a medium-severity vulnerability in Mongodb with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-457.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
CVSS v4: 7.1
EPSS exploit prediction: 0% (30th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-35853
Weakness: CWE-457
Affected product: Mongodb
Published: 2026-06-09
Last modified: 2026-07-23

Description

An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command

Frequently asked questions

What is CVE-2026-9754?: An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command
How severe is CVE-2026-9754?: CVE-2026-9754 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2026-9754 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (30th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-9754?: CVE-2026-9754 affects Mongodb. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-9754?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-9754 have an EU (EUVD) identifier?: Yes. CVE-2026-9754 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-35853.
When was CVE-2026-9754 published?: CVE-2026-9754 was published on 2026-06-09 and last updated on 2026-07-23.

References

https://jira.mongodb.org/browse/SERVER-122207

Affected products (1)

cpe:2.3:a:mongodb:mongodb:*:*:*:*:-:*:*:*

More vulnerabilities in Mongodb

CVE-2017-15535 — Critical (CVSS 9.1): MongoDB 3.4.x before 3.4.10, and 3.5.x-development, has a disabled-by-default configuration setting,…
CVE-2026-18692 — High (CVSS 8.8): An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write…
CVE-2026-18691 — High (CVSS 8.8): An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to…
CVE-2026-11933 — High (CVSS 8.8): A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents…
CVE-2026-8053 — High (CVSS 8.8): An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write…
CVE-2026-4148 — High (CVSS 8.8): A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with the read role who…

All CVEs affecting Mongodb →

Other CWE-457 vulnerabilities

CVE-2026-6748 — Critical (CVSS 9.8): Uninitialized memory in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 150, Firefox ESR…
CVE-2025-54874 — Critical (CVSS 9.8): OpenJPEG is an open-source JPEG 2000 codec. In OpenJPEG from 2.5.1 through 2.5.3, a call to opj_jp2_read_header may…
CVE-2025-53644 — Critical (CVSS 9.8): OpenCV is an Open Source Computer Vision Library. Versions 4.10.0 and 4.11.0 have an uninitialized pointer variable on…
CVE-2026-78935 — Critical (CVSS 9.6): Use of uninitialized variable in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker to…
CVE-2026-14405 — Critical (CVSS 9.6): Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code…
CVE-2026-84639 — Critical (CVSS 9.1): Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used. This vulnerability…

Browse all CWE-457 vulnerabilities →

Threat intelligence

Threat-intel indicators referencing this CVE:

210.245.84.39 (ipv4-addr)