Is CVE-2026-118383 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118383 being exploited in the wild.

How severe is CVE-2026-118383?

Critical severity, with a CVSS score of 9, published 10 November 2026.

Which products and versions are affected?

MongoDB Server all versions before 4.4.32, 5.0.35, 6.0.30, 7.0.48, 8.0.37, 8.3.16, 9.0.7.

Is there a fix for CVE-2026-118383?

Yes: fixed in MongoDB Server 4.4.32, 5.0.35, 6.0.30, 7.0.48, 8.0.37, 8.3.16, 9.0.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-118383 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-118383?

Check whether you run MongoDB Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118383: MongoDB Server use-after-free in replication catch-up

CVE-2026-118383 · Severity: critical · CVSS 9 · Published 2026-11-10

MongoDB Server, a widely-used database platform, contains a use-after-free vulnerability in its replication component that triggers when a newly elected replica set primary completes synchronization. An attacker without authentication can exploit this flaw to crash the database server or potentially execute arbitrary code within the server process, affecting all replica set configurations except standalone deployments.

Technologies: MongoDB Server. Vendors: MongoDB.

Quick answers

Is CVE-2026-118383 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118383 being exploited in the wild.
How severe is CVE-2026-118383?: Critical severity, with a CVSS score of 9, published 10 November 2026.
Which products and versions are affected?: MongoDB Server all versions before 4.4.32, 5.0.35, 6.0.30, 7.0.48, 8.0.37, 8.3.16, 9.0.7.
Is there a fix for CVE-2026-118383?: Yes: fixed in MongoDB Server 4.4.32, 5.0.35, 6.0.30, 7.0.48, 8.0.37, 8.3.16, 9.0.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118383 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-118383?: Check whether you run MongoDB Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: MongoDB Server 4.4.32, 5.0.35, 6.0.30, 7.0.48, 8.0.37, 8.3.16, 9.0.7

Technical details

A use-after-free vulnerability exists in CatchupState::abort() reentrancy within MongoDB's replication component, triggered by unauthenticated requests during replica set primary catch-up completion. The vulnerability affects replica set members including shard and config server replicas in sharded clusters; standalone mongod instances are not vulnerable. Exploitation can result in server termination or arbitrary code execution in the server process context.

Affected products

MongoDB Server all versions before 4.4.32, 5.0.35, 6.0.30, 7.0.48, 8.0.37, 8.3.16, 9.0.7

Timeline

2026-11-10: disclosed: CVE-2026-118383 published
2026-11-10: patched: Fixed versions released across all supported branches

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.