Quick answers
- Is CVE-2026-84962 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-84962 being exploited in the wild.
- How severe is CVE-2026-84962?
- Medium severity, with a CVSS score of 4.2, published 3 September 2026.
- Which products and versions are affected?
- MongoDB mongocrypt.
- Is there a fix for CVE-2026-84962?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-84962 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-84962?
- Check whether you run MongoDB Libmongocrypt or MongoDB Mongocrypt. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability exists in MongoDB's Crypt library (mongocrypt) and involves improper validation of key vault contents. An attacker with write access to the MongoDB key vault can inject or modify data that causes an authorized client application to issue arbitrary authenticated API calls to Google Cloud KMS using the client's own identity. This escalates limited database-level write access into cloud key management privileges. The attack requires the legitimate client to be already connected and authenticated to both MongoDB and Google Cloud KMS; the vulnerability is triggered when the client processes malicious data from the key vault. No patch status is currently documented in the available advisory information.
Affected products
- MongoDB mongocrypt
Timeline
- 2026-09-03: disclosed