MediumVulnerabilityMonitoring
HKCERT reports multiple MongoDB vulnerabilities, vendor fixes advised
HKCERT reports multiple MongoDB vulnerabilities rated medium risk; check MongoDB’s security alerts page and apply vendor fixes.
- Published
- CVE
- CVE-2026-112368
CVE-2026-113870
CVE-2026-114643
CVE-2026-114644
CVE-2026-114645
CVE-2026-114646
CVE-2026-114647
CVE-2026-114648
CVE-2026-114649
CVE-2026-114650
CVE-2026-114651
CVE-2026-114652
CVE-2026-114653
CVE-2026-114654
CVE-2026-114655
CVE-2026-115929
CVE-2026-115930
CVE-2026-116641
CVE-2026-118383
CVE-2026-118510
CVE-2026-118581
CVE-2026-119179
CVE-2026-119672
CVE-2026-119673
CVE-2026-119674
CVE-2026-119675
CVE-2026-120567
CVE-2026-120673
CVE-2026-120678
CVE-2026-120684
CVE-2026-120803
CVE-2026-120804
CVE-2026-120805
CVE-2026-120806
CVE-2026-120807
CVE-2026-120808
CVE-2026-120809
CVE-2026-120810
CVE-2026-120811
CVE-2026-120812
CVE-2026-120813
CVE-2026-120814
CVE-2026-120815
CVE-2026-120816
CVE-2026-120817
CVE-2026-120818
CVE-2026-120819
CVE-2026-120820
CVE-2026-120821
CVE-2026-120822
CVE-2026-120823
CVE-2026-120824
CVE-2026-120825
CVE-2026-120826
CVE-2026-120828
CVE-2026-120952
CVE-2026-120953
CVE-2026-120954
CVE-2026-120955
CVE-2026-120956
CVE-2026-120959 - Ecosystem
- Enterprise software
- Exploitation
- No. The HKCERT bulletin does not report exploitation in the wild.
Live scores
CVE-2026-112368- EPSS
- 0.003
low predicted chance of attack - VEDAS
- 0.049
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-113870- EPSS
- 0.002
low predicted chance of attack - VEDAS
- 0.046
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-114643- EPSS
- 0.004
low predicted chance of attack - VEDAS
- 0.046
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-114644- EPSS
- 0.005
low predicted chance of attack - VEDAS
- 0.051
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-114645- EPSS
- 0.002
low predicted chance of attack - VEDAS
- 0.056
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-114646- EPSS
- 0.003
low predicted chance of attack - VEDAS
- 0.050
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-114647- EPSS
- 0.003
low predicted chance of attack - VEDAS
- 0.054
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-114648- EPSS
- 0.003
low predicted chance of attack - VEDAS
- 0.054
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-114649- EPSS
- 0.002
low predicted chance of attack - VEDAS
- 0.050
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-114650- EPSS
- 0.001
low predicted chance of attack - VEDAS
- 0.045
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-114651- EPSS
- 0.004
low predicted chance of attack - VEDAS
- 0.056
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-114652- EPSS
- 0.003
low predicted chance of attack - VEDAS
- 0.056
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-114653- EPSS
- 0.002
low predicted chance of attack - VEDAS
- 0.047
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-114654- EPSS
- 0.003
low predicted chance of attack - VEDAS
- 0.049
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-114655- EPSS
- 0.003
low predicted chance of attack - VEDAS
- 0.048
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-115929- EPSS
- 0.002
low predicted chance of attack - VEDAS
- 0.053
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-115930- EPSS
- 0.001
low predicted chance of attack - VEDAS
- 0.053
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-116641- EPSS
- 0.001
low predicted chance of attack - VEDAS
- 0.054
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-118383- EPSS
- 0.007
low predicted chance of attack - VEDAS
- 0.512
likely exploited - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-118510- EPSS
- 0.003
low predicted chance of attack - VEDAS
- 0.053
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-118581- EPSS
- 0.002
low predicted chance of attack - VEDAS
- 0.050
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-119179- EPSS
- 0.003
low predicted chance of attack - VEDAS
- 0.055
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-119672- EPSS
- 0.002
low predicted chance of attack - VEDAS
- 0.049
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-119673- EPSS
- 0.001
low predicted chance of attack - VEDAS
- 0.046
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-119674- EPSS
- 0.002
low predicted chance of attack - VEDAS
- 0.046
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-119675- EPSS
- 0.002
low predicted chance of attack - VEDAS
- 0.043
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-120567- EPSS
- 0.002
low predicted chance of attack - VEDAS
- 0.054
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-120673- EPSS
- 0.001
low predicted chance of attack - VEDAS
- 0.051
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-120678- EPSS
- 0.004
low predicted chance of attack - VEDAS
- 0.047
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-120684- EPSS
- 0.003
low predicted chance of attack - VEDAS
- 0.049
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-120803- EPSS
- 0.004
low predicted chance of attack - VEDAS
- 0.048
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-120804- EPSS
- 0.006
low predicted chance of attack - VEDAS
- 0.057
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-120805- EPSS
- 0.002
low predicted chance of attack - VEDAS
- 0.047
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-120806- EPSS
- 0.002
low predicted chance of attack - VEDAS
- 0.045
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-120807- EPSS
- 0.002
low predicted chance of attack - VEDAS
- 0.047
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-120808- EPSS
- 0.002
low predicted chance of attack - VEDAS
- 0.056
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-120809- EPSS
- 0.004
low predicted chance of attack - VEDAS
- 0.051
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-120810- EPSS
- 0.003
low predicted chance of attack - VEDAS
- 0.055
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-120811- EPSS
- 0.003
low predicted chance of attack - VEDAS
- 0.045
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-120812- EPSS
- 0.003
low predicted chance of attack - VEDAS
- 0.057
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-120813- EPSS
- 0.002
low predicted chance of attack - VEDAS
- 0.055
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-120814- EPSS
- 0.004
low predicted chance of attack - VEDAS
- 0.047
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-120815- EPSS
- 0.001
low predicted chance of attack - VEDAS
- 0.045
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-120816- EPSS
- 0.003
low predicted chance of attack - VEDAS
- 0.045
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-120817- EPSS
- 0.003
low predicted chance of attack - VEDAS
- 0.051
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-120818- EPSS
- 0.004
low predicted chance of attack - VEDAS
- 0.047
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-120819- EPSS
- 0.004
low predicted chance of attack - VEDAS
- 0.051
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-120820- EPSS
- 0.004
low predicted chance of attack - VEDAS
- 0.055
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-120821- EPSS
- 0.004
low predicted chance of attack - VEDAS
- 0.050
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-120822- EPSS
- 0.003
low predicted chance of attack - VEDAS
- 0.050
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-120823- EPSS
- 0.003
low predicted chance of attack - VEDAS
- 0.055
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-120824- EPSS
- 0.006
low predicted chance of attack - VEDAS
- 0.055
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-120825- EPSS
- 0.004
low predicted chance of attack - VEDAS
- 0.054
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-120826- EPSS
- 0.004
low predicted chance of attack - VEDAS
- 0.050
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-120828- EPSS
- 0.005
low predicted chance of attack - VEDAS
- 0.054
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-120952- EPSS
- 0.004
low predicted chance of attack - VEDAS
- 0.046
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-120953- EPSS
- 0.002
low predicted chance of attack - VEDAS
- 0.049
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-120954- EPSS
- 0.002
low predicted chance of attack - VEDAS
- 0.052
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-120955- EPSS
- 0.004
low predicted chance of attack - VEDAS
- 0.045
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-120956- EPSS
- 0.003
low predicted chance of attack - VEDAS
- 0.046
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-120959- EPSS
- 0.002
low predicted chance of attack - VEDAS
- 0.046
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
What happened
According to HKCERT, multiple vulnerabilities were identified in MongoDB. In a bulletin released on 11 November 2026, HKCERT says a remote attacker could exploit some of them to cause denial of service, elevation of privilege, security restriction bypass, sensitive information disclosure, remote code execution and data manipulation on a targeted system. HKCERT rates the risk as Medium and classes the bulletin under database servers. HKCERT: MongoDB Multiple Vulnerabilities
HKCERT lists a large set of CVE identifiers, running from CVE-2026-112368 to CVE-2026-120959. The full list is in the front matter of this advisory and in the bulletin. HKCERT names MongoDB as the source and points to the vendor’s security alerts page for details. HKCERT: MongoDB Multiple Vulnerabilities
Not confirmed by the source: which MongoDB versions are affected, which fixed versions exist, which impact belongs to which CVE, and whether any of these flaws is exploited in the wild. HKCERT says only that “some” of the flaws could allow the listed impacts. This is a single-outlet report and we have not independently verified it against the vendor page.
Am I affected?
HKCERT does not list affected products or versions in its bulletin. It refers readers to MongoDB’s security alerts page for that information. HKCERT: MongoDB Multiple Vulnerabilities
If you operate MongoDB servers, treat yourself as potentially affected until you have compared your deployed versions with the vendor’s list. Version-level details are not confirmed in the source we used.
What to do now
- Open the MongoDB security alerts page that HKCERT links (mongodb.com/resources/products/alerts, security section) and find the entries matching the CVEs in this advisory.
- Inventory your MongoDB deployments and compare their versions with the affected products listed by the vendor.
- Apply the fixes issued by MongoDB. HKCERT advises visiting the vendor website for details before installing. HKCERT: MongoDB Multiple Vulnerabilities
- Check individual CVEs on their NVD pages for per-issue detail, for example CVE-2026-112368.