CVE-2026-9746 - Server Crashes Due to Exchange Option
CVE-2026-9746 - Server Crashes Due to Exchange Option
DNB reports on CVE-2026-9746, a server vulnerability identified where, when using $changestreams and $_requestReshardingResumeToken with the exchange option, the server hits an invariant which causes it to crash. This vulnerability requires no special privileges, though the user must be logged in to issue the statement that triggers the crash. 🚨
Vulnerability Details
The vulnerability details for CVE-2026-9746 were officially received by [email protected] on June 9, 2026. At that time, a description was added detailing that “When using $changestreams and $_requestReshardingResumeToken with the exchange option, the server hits an invariant which causes it to crash. There are no special privileges needed. The user must be logged in to issue the statement.” 🔍
Technical Information
Further technical details added to the CVE-2026-9746 record include its CVSS V4.0 score: AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. The vulnerability also received a CVSS V3.1 score of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. Additionally, it was assigned CWE-617 as its Common Weakness Enumeration. 📊
Impact and Scope
Regarding the impact and scope, “The following products are affected by CVE-2026-9746 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.” Currently, “No affected product recorded yet.” In terms of public exploits, “We scan GitHub repositories to detect new proof-of-concept exploits.” While “Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub,” the “Results are limited to the first 15 repositories due to potential performance issues,” and no specific public exploits are listed for CVE-2026-9746. 🔒
For additional information, a reference to SERVER-124190 has been provided.
To read the complete article see: Read full article