# MongoDB 8.3.7

MongoDB 8.3.7, released June 11, 2026, fixes 24 CVEs in MongoDB. None of them is reported as exploited. Patch Radar priority: Urgent. The latest MongoDB is 9.0.4, which also fixes every one of these CVEs.

- Web page: https://patchblox.com/security/fix/windows-app/mongodb.server-8.3.7
- Platform: Windows apps
- Released: Jun 11, 2026
- Priority: Urgent (Closes CVE-2026-13072, rated Critical)
- CVEs: 24, exploited: 0, on CISA KEV: 0
- Superseded by: [MongoDB 9.0.4](https://patchblox.com/security/data/product/windows-app/mongodb.md), the latest version, which also fixes every CVE listed here

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [MongoDB](https://patchblox.com/security/data/product/windows-app/mongodb.md) |  | 8.3.7 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-13072](https://patchblox.com/security/data/cve/CVE-2026-13072.md) | Urgent | MongoDB Improper Input Validation in Compute Mode External Data Processing Leading to Memory Corruption | 9.2 | 0.0040 |  |
| [CVE-2026-13065](https://patchblox.com/security/data/cve/CVE-2026-13065.md) | High | MongoDB $linearFill Window Function Improper Input Validation Leading to Process Termination | 7.1 | 0.0050 |  |
| [CVE-2026-13064](https://patchblox.com/security/data/cve/CVE-2026-13064.md) | High | MongoDB $jsonSchema Query Operator Excessive CPU Consumption Leading to Denial of Service | 7.1 | 0.0045 |  |
| [CVE-2026-13060](https://patchblox.com/security/data/cve/CVE-2026-13060.md) | High | $graphLookup Aggregation Stage Authorization Check Inconsistency Allowing Unauthorized Collection Access | 7.1 | 0.0043 |  |
| [CVE-2026-13077](https://patchblox.com/security/data/cve/CVE-2026-13077.md) | High | Out-of-Bounds Heap Read in BSON CodeWScope Element Parsing via Malformed BSONColumn Data | 7.1 | 0.0042 |  |
| [CVE-2026-13071](https://patchblox.com/security/data/cve/CVE-2026-13071.md) | High | Server-Side JavaScript Aggregation Expression Memory Safety Issue Leading to Process Termination | 7.1 | 0.0042 |  |
| [CVE-2026-13075](https://patchblox.com/security/data/cve/CVE-2026-13075.md) | High | $rankFusion and $scoreFusion Unbounded Memory Allocation During Error Suggestion Generation | 7.1 | 0.0042 |  |
| [CVE-2026-13076](https://patchblox.com/security/data/cve/CVE-2026-13076.md) | High | Aggregation Framework Memory Exhaustion Leading to Process Termination | 7.1 | 0.0042 |  |
| [CVE-2026-9737](https://patchblox.com/security/data/cve/CVE-2026-9737.md) | High | Find command with $meta sort can lead to crash | 7.1 | 0.0042 |  |
| [CVE-2026-13055](https://patchblox.com/security/data/cve/CVE-2026-13055.md) | High | Server crash via aggregation pipeline expression with compound wildcard index specification | 7.1 | 0.0040 |  |
| [CVE-2026-13056](https://patchblox.com/security/data/cve/CVE-2026-13056.md) | High | A user with read access can cause a DoS by executing a specifically crafted query to consume a large amount of RAM | 7.1 | 0.0040 |  |
| [CVE-2026-13058](https://patchblox.com/security/data/cve/CVE-2026-13058.md) | High | Transaction Command Insufficient Input Validation Leading to Process Termination | 7.1 | 0.0040 |  |
| [CVE-2026-13059](https://patchblox.com/security/data/cve/CVE-2026-13059.md) | High | Improper Validation of Client-Supplied Command Parameters Allowing Role-Based Access Control Bypass | 8.6 | 0.0038 |  |
| [CVE-2026-13066](https://patchblox.com/security/data/cve/CVE-2026-13066.md) | High | Server-Side JavaScript DBPointer BSON Serialization Memory Disclosure | 7.1 | 0.0037 |  |
| [CVE-2026-13069](https://patchblox.com/security/data/cve/CVE-2026-13069.md) | High | Queryable Encryption FLE2 Find Payload Missing Input Validation Leading to Resource Exhaustion | 7.1 | 0.0029 |  |
| [CVE-2026-13062](https://patchblox.com/security/data/cve/CVE-2026-13062.md) | High | MongoDB mongos Improper Validation of Internal Flags in Queryable Encryption Write Commands on Sharded Clusters | 7.1 | 0.0019 |  |
| [CVE-2026-13067](https://patchblox.com/security/data/cve/CVE-2026-13067.md) | High | tlsCATrusts Role Restriction Not Enforced via PROXY Protocol v2 on Unix Domain Socket | 7.2 | 0.0010 |  |
| [CVE-2026-13074](https://patchblox.com/security/data/cve/CVE-2026-13074.md) | Routine | Awaitable Hello Command in Exhaust Mode Unthrottled Response Loop Leading to Denial of Service | 6.9 | 0.0044 |  |
| [CVE-2026-13063](https://patchblox.com/security/data/cve/CVE-2026-13063.md) | Routine | libmongocrypt Improper Input Validation Leading to Process Termination | 5.3 | 0.0040 |  |
| [CVE-2026-13078](https://patchblox.com/security/data/cve/CVE-2026-13078.md) | Routine | Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader | 6.3 | 0.0038 |  |
| [CVE-2026-13057](https://patchblox.com/security/data/cve/CVE-2026-13057.md) | Routine | Authorization Bypass via Client-Supplied $search.mergingPipeline Leaks Unauthorized Collection Data Through $$SEARCH_META | 6.0 | 0.0035 |  |
| [CVE-2026-13061](https://patchblox.com/security/data/cve/CVE-2026-13061.md) | Routine | Improper Access Control Allowing Cross-User Session Metadata Disclosure in $listSessions Aggregation Stage | 5.3 | 0.0028 |  |
| [CVE-2026-13068](https://patchblox.com/security/data/cve/CVE-2026-13068.md) | Routine | MongoDB mongos Improper Authorization Check in Cursor Termination Allowing Cross-Database Privilege Misuse | 2.3 | 0.0025 |  |
| [CVE-2026-13070](https://patchblox.com/security/data/cve/CVE-2026-13070.md) | Routine | Improper Validation of OCSP Response During Outbound TLS Handshake Leading to Process Termination | 6.0 | 0.0013 |  |

---

Data as of 2026-11-09T07:25:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.