# MongoDB 8.3.11

MongoDB 8.3.11, released September 9, 2026, fixes 48 CVEs in MongoDB. None of them is reported as exploited. Patch Radar priority: Urgent. The latest MongoDB is 9.0.4, which also fixes every one of these CVEs.

- Web page: https://patchblox.com/security/fix/windows-app/mongodb.server-8.3.11
- Platform: Windows apps
- Released: Sep 9, 2026
- Priority: Urgent (Closes CVE-2026-82067, rated Critical)
- CVEs: 48, exploited: 0, on CISA KEV: 0
- Superseded by: [MongoDB 9.0.4](https://patchblox.com/security/data/product/windows-app/mongodb.md), the latest version, which also fixes every CVE listed here

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [MongoDB](https://patchblox.com/security/data/product/windows-app/mongodb.md) |  | 8.3.11 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-82067](https://patchblox.com/security/data/cve/CVE-2026-82067.md) | Urgent | Improper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause Authorization to Remain Disabled at Startup | 9.2 | 0.0051 |  |
| [CVE-2026-18691](https://patchblox.com/security/data/cve/CVE-2026-18691.md) | Urgent | Improper Authentication in MongoDB Intra-Cluster Connections Allows Credential Exposure | 9.0 | 0.0036 |  |
| [CVE-2026-18692](https://patchblox.com/security/data/cve/CVE-2026-18692.md) | High | Use-After-Free in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Remote Code Execution | 7.7 | 0.0058 |  |
| [CVE-2026-82071](https://patchblox.com/security/data/cve/CVE-2026-82071.md) | High | Insufficient Validation of Storage Engine Configuration Options in MongoDB Server Leads to Out-of-Bounds Write | 7.2 | 0.0054 |  |
| [CVE-2026-82061](https://patchblox.com/security/data/cve/CVE-2026-82061.md) | High | Use-After-Free in MongoDB Server Query Execution Memory Tracking Subsystem Leads to Denial of Service | 7.2 | 0.0053 |  |
| [CVE-2026-82064](https://patchblox.com/security/data/cve/CVE-2026-82064.md) | High | Unauthenticated Denial of Service in MongoDB Server via Assertion Failure in Read Concern Processing on Replica Set Members | 8.7 | 0.0052 |  |
| [CVE-2026-82075](https://patchblox.com/security/data/cve/CVE-2026-82075.md) | High | Uncontrolled Resource Consumption in MongoDB Sharded Cluster Router Allows Unauthenticated Denial of Service | 8.7 | 0.0052 |  |
| [CVE-2026-82052](https://patchblox.com/security/data/cve/CVE-2026-82052.md) | High | $regexFindAll may crash mongod server when byte-matching multi-byte UTF-8 chars | 7.1 | 0.0050 |  |
| [CVE-2026-18711](https://patchblox.com/security/data/cve/CVE-2026-18711.md) | High | Use-After-Free in MongoDB Query Execution Engine Leads to Denial of Service and Potential Memory Disclosure | 7.1 | 0.0049 |  |
| [CVE-2026-18706](https://patchblox.com/security/data/cve/CVE-2026-18706.md) | High | Use-After-Free in MongoDB $graphLookup Aggregation Stage Leads to Denial of Service and Potential Remote Code Execution | 7.5 | 0.0047 |  |
| [CVE-2026-82062](https://patchblox.com/security/data/cve/CVE-2026-82062.md) | High | Improper Authorization in MongoDB Server applyOps Command Allows Writes to Arbitrary Internal Storage Tables via Feature Gate Bypass | 7.0 | 0.0045 |  |
| [CVE-2026-18697](https://patchblox.com/security/data/cve/CVE-2026-18697.md) | High | Improper Input Validation in MongoDB Aggregation Framework Allows Unauthenticated Denial of Service on mongos | 8.7 | 0.0044 |  |
| [CVE-2026-82057](https://patchblox.com/security/data/cve/CVE-2026-82057.md) | High | Type Confusion in MongoDB Server WiredTiger Storage Engine via Custom Collection Configuration Leads to Persistent Denial of Service | 7.1 | 0.0042 |  |
| [CVE-2026-82053](https://patchblox.com/security/data/cve/CVE-2026-82053.md) | High | Improper Session Handling in MongoDB Server LDAP Authorization Integration Leads to Incorrect Role Assignment | 7.6 | 0.0041 |  |
| [CVE-2026-82076](https://patchblox.com/security/data/cve/CVE-2026-82076.md) | High | Integer Overflow in Query Planner Leads to Unbounded Memory Allocation and Denial of Service in MongoDB Server | 7.1 | 0.0041 |  |
| [CVE-2026-18690](https://patchblox.com/security/data/cve/CVE-2026-18690.md) | High | Improper Authorization in MongoDB Server Allows Unauthorized Actions on System Collections | 7.2 | 0.0041 |  |
| [CVE-2026-18695](https://patchblox.com/security/data/cve/CVE-2026-18695.md) | High | Improper Input Validation in MongoDB Timeseries Query Processing Leads to Denial of Service | 7.1 | 0.0040 |  |
| [CVE-2026-18701](https://patchblox.com/security/data/cve/CVE-2026-18701.md) | High | Type Confusion in MongoDB Query Subsystem Leads to Denial of Service | 7.1 | 0.0040 |  |
| [CVE-2026-82054](https://patchblox.com/security/data/cve/CVE-2026-82054.md) | High | Uncontrolled Resource Consumption in MongoDB Server JSON Pointer Parser Leads to Denial of Service | 7.1 | 0.0040 |  |
| [CVE-2026-82055](https://patchblox.com/security/data/cve/CVE-2026-82055.md) | High | Null Pointer Dereference in MongoDB Server 2dsphere Index Key Generation Leads to Denial of Service | 7.1 | 0.0040 |  |
| [CVE-2026-82058](https://patchblox.com/security/data/cve/CVE-2026-82058.md) | High | Unhandled Exception in MongoDB Server JSON Schema Validation Error Generation Leads to Denial of Service | 7.1 | 0.0040 |  |
| [CVE-2026-82065](https://patchblox.com/security/data/cve/CVE-2026-82065.md) | High | Insufficient Validation of Storage Configuration Options in MongoDB Server Leads to Persistent Denial of Service via Corrupted Metadata | 7.1 | 0.0040 |  |
| [CVE-2026-82068](https://patchblox.com/security/data/cve/CVE-2026-82068.md) | High | Persistent Fatal Assertion Crash in MongoDB Server via Crafted Retryable Write Commands Leads to Denial of Service | 7.1 | 0.0040 |  |
| [CVE-2026-18696](https://patchblox.com/security/data/cve/CVE-2026-18696.md) | High | Improper Authorization in MongoDB applyOps Command Handling Allows Unauthorized DDL Operations on Collections | 7.0 | 0.0040 |  |
| [CVE-2026-18688](https://patchblox.com/security/data/cve/CVE-2026-18688.md) | High | Out-of-Bounds Read in MongoDB Aggregation Framework Leads to Denial of Service and Potential Memory Disclosure | 7.1 | 0.0040 |  |
| [CVE-2026-18694](https://patchblox.com/security/data/cve/CVE-2026-18694.md) | High | Out-of-Bounds Read in MongoDB Geospatial Query Processing Leads to Denial of Service and Potential Memory Disclosure | 7.1 | 0.0040 |  |
| [CVE-2026-18705](https://patchblox.com/security/data/cve/CVE-2026-18705.md) | High | Improper Authorization in MongoDB Atlas Vector Search Allows Unauthorized Access to Protected View Data | 7.1 | 0.0036 |  |
| [CVE-2026-82073](https://patchblox.com/security/data/cve/CVE-2026-82073.md) | High | Improper Validation in MongoDB Server Aggregation Framework Allows Authorization Bypass and Unauthorized Collection Access with Atlas Search | 7.1 | 0.0036 |  |
| [CVE-2026-18693](https://patchblox.com/security/data/cve/CVE-2026-18693.md) | High | Out-of-Bounds Read/Write in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Memory Disclosure | 7.2 | 0.0034 |  |
| [CVE-2026-82070](https://patchblox.com/security/data/cve/CVE-2026-82070.md) | High | Insufficiently Protected Credentials in MongoDB Server Diagnostic Reporting Interface | 7.1 | 0.0033 |  |
| [CVE-2026-89099](https://patchblox.com/security/data/cve/CVE-2026-89099.md) | High | Race Condition in MongoDB Server Document Value Layer Leads to Memory Corruption | 7.7 | 0.0032 |  |
| [CVE-2026-18704](https://patchblox.com/security/data/cve/CVE-2026-18704.md) | High | Improper Authorization in MongoDB Aggregation Framework Allows Read-Only User to Perform Unauthorized Write Operations | 7.1 | 0.0029 |  |
| [CVE-2026-18712](https://patchblox.com/security/data/cve/CVE-2026-18712.md) | High | Improper Authorization in MongoDB Queryable Encryption Maintenance Operations Allows Unauthorized Modification of Other Collections | 7.2 | 0.0024 |  |
| [CVE-2026-18687](https://patchblox.com/security/data/cve/CVE-2026-18687.md) | High | Improper Validation in MongoDB Queryable Encryption Maintenance Operation Leads to Denial of Service and Index Corruption | 7.1 | 0.0023 |  |
| [CVE-2026-82069](https://patchblox.com/security/data/cve/CVE-2026-82069.md) | Routine | Improper Redaction of Query Literals in MongoDB Server Query Statistics Serialization on Sharded Cluster Router | 5.1 | 0.0041 |  |
| [CVE-2026-18699](https://patchblox.com/security/data/cve/CVE-2026-18699.md) | Routine | Improper Input Validation in MongoDB Query Planner Leads to Denial of Service | 6.0 | 0.0040 |  |
| [CVE-2026-18700](https://patchblox.com/security/data/cve/CVE-2026-18700.md) | Routine | Use-After-Free in MongoDB Geospatial Validation Leads to Denial of Service | 6.0 | 0.0040 |  |
| [CVE-2026-82066](https://patchblox.com/security/data/cve/CVE-2026-82066.md) | Routine | Heap Out-of-Bounds Read in MongoDB Server Query Planning Component | 5.3 | 0.0039 |  |
| [CVE-2026-18708](https://patchblox.com/security/data/cve/CVE-2026-18708.md) | Routine | Improper Neutralization of Input in MongoDB Server's JavaScript Scripting Engine Leads to Unauthorized Code Execution Within Query Scopes | 5.3 | 0.0038 |  |
| [CVE-2026-82059](https://patchblox.com/security/data/cve/CVE-2026-82059.md) | Routine | Improper Access Restriction of Internal Aggregation Expression in MongoDB Server Leads to Assertion Failure and Denial of Service | 6.0 | 0.0037 |  |
| [CVE-2026-82063](https://patchblox.com/security/data/cve/CVE-2026-82063.md) | Routine | Use-After-Free in MongoDB Server Cursor Management Component Leads to Denial of Service | 6.0 | 0.0037 |  |
| [CVE-2026-18707](https://patchblox.com/security/data/cve/CVE-2026-18707.md) | Routine | Improper Input Validation in MongoDB Aggregation Command Handling Leads to Denial of Service | 5.3 | 0.0035 |  |
| [CVE-2026-82060](https://patchblox.com/security/data/cve/CVE-2026-82060.md) | Routine | Insufficient Validation of Shard Key Values in MongoDB Server Leads to Query Operator Injection in Change Stream Post-Image Lookups | 2.3 | 0.0034 |  |
| [CVE-2026-82056](https://patchblox.com/security/data/cve/CVE-2026-82056.md) | Routine | Race Condition in MongoDB Server Text Index Query Parsing Leads to Heap Use-After-Free and Denial of Service | 6.0 | 0.0033 |  |
| [CVE-2026-18702](https://patchblox.com/security/data/cve/CVE-2026-18702.md) | Routine | Improper Authorization in MongoDB profile Command Allows Unauthorized Modification of Server-Wide Diagnostic Settings | 5.3 | 0.0028 |  |
| [CVE-2026-18698](https://patchblox.com/security/data/cve/CVE-2026-18698.md) | Routine | Improper Authorization in MongoDB Server Allows Unauthorized Actions on System Collections via the validate Command | 5.3 | 0.0024 |  |
| [CVE-2026-18709](https://patchblox.com/security/data/cve/CVE-2026-18709.md) | Routine | Missing Authorization in MongoDB Sharded Transaction Commit/Abort Handling Leads to Cross-Shard Data Inconsistency | 5.9 | 0.0020 |  |
| [CVE-2026-18703](https://patchblox.com/security/data/cve/CVE-2026-18703.md) | Routine | Improper Enforcement of Authentication Mechanism Restrictions in MongoDB Server Allows Use of Disabled Authentication Method | 2.3 | 0.0014 |  |

---

Data as of 2026-11-10T01:44:33Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.