---
id: CVE-2026-82068
title: >-
  A security issue in MongoDB Server allows an authenticated user with write
  privileges to trigger a persistent fatal assertion crash by sending specially
  crafted retryable write commands
summary: >-
  A security issue in MongoDB Server allows an authenticated user with write
  privileges to trigger a persistent fatal assertion crash by sending specially
  crafted retryable write commands. The crash state is durably persisted,
  causing the …
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-617
vendor: mongodb
product: mongodb
affected:
  - 'mongodb >= 7.0.0, < 7.0.41'
  - 'mongodb >= 8.0.0, < 8.0.30'
  - 'mongodb >= 8.3.0, < 8.3.9'
patched:
  - mongodb 8.3.9
published: '2026-09-08'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T20:38:17.227'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-82068'
references:
  - url: 'https://jira.mongodb.org/browse/SERVER-131326'
    label: cna@mongodb.com
tags:
  - nvd
  - cve.org
epss: 0.00402
epssPercentile: 0.31647
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-08T17:53:53.089448Z'
ingestedAt: '2026-09-08T16:34:19.257Z'
---

## Overview

A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent fatal assertion crash by sending specially crafted retryable write commands. The crash state is durably persisted, causing the server process to repeatedly crash on restart and potentially propagating to additional nodes in a sharded cluster. Manual intervention is required to restore service availability.

## Affected

- `mongodb >= 7.0.0, < 7.0.41`
- `mongodb >= 8.0.0, < 8.0.30`
- `mongodb >= 8.3.0, < 8.3.9`

## Remediation

Upgrade past the affected range:

- `mongodb 8.3.9`