Quick answers
- Is CVE-2026-8063 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-8063 being exploited in the wild.
- How severe is CVE-2026-8063?
- Medium severity, with a CVSS score of 6.5, published 7 May 2026.
- Which products and versions are affected?
- MongoDB MongoDB Server 8.2.0 to 8.2.6.
- Is there a fix for CVE-2026-8063?
- A patch was published on 2026-03-17: Issue resolved in development tracking system. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-8063 attacked?
- It is attacked over the network, in an operating system.
- Am I affected by CVE-2026-8063?
- Check whether you run MongoDB. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A NULL pointer dereference exists in MongoDB Server's aggregation engine when resolving views. The server inspects the aggregation pipeline to check for Atlas Search stages but fails to verify if the input pipeline array for $rankFusion or $scoreFusion is non-empty before accessing its first element. An authenticated attacker with network access can trigger this by supplying an empty pipeline, leading to a daemon crash (DoS). The issue is fixed in MongoDB Server versions 8.2.7, 8.3.0-rc1, and 9.0.0-rc0.
Affected products
- MongoDB MongoDB Server 8.2.0 to 8.2.6
Timeline
- 2026-03-17: patched: Issue resolved in development tracking system.
- 2026-05-07: disclosed: Initial advisory publication.