Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bounds or crash the server. $_internalApplyOplogUpdate can be executed by any authenticated user with access to the aggregate command.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
⚠️ Vulnerabilidades en productos MongoDB ❗ CVE-2026-9753 ❗ CVE-2026-9742 ❗ CVE-2026-9740 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-mongodb-3/ https://t.co/LQbWTtCKWM
Post summary
The tweet announces several MongoDB CVEs and links to external sources for more info, but provides no technical, PoC, exploitation, or mitigation data.
🚨 HIGH SEVERITY: CVE-2026-9753 (CVSS 8.1) MongoDB aggregation pipeline vulnerability allows authenticated users to trigger out-of-bounds memory access or server crash via malformed binary diff. Affects: $_internalApplyOplogUpdate stage Impact: Data exposure + DoS https://t.co/BufynJidkv
Post summary
A high‑severity CVE‑2026‑9753 affecting MongoDB's aggregation pipeline has been disclosed, detailing out‑of‑bounds memory access and DoS potential, with no patch or active exploitation information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | mongodb | mongodb | - | - | - |