{"id":"EM-20261111-3565","url":"https://cyber.eventmonitor.net/incident/EM-20261111-3565/critical-vulnerability-cve-2026-118383/","type":"cve","title":"Critical Vulnerability (CVE-2026-118383)","subtitle":"CVE-2026-118383","subject":"CVE-2026-118383","status":"Developing","severity":"critical","affected":[],"headline":null,"born":"2026-11-11T05:59:43.000Z","firstSignal":"2026-11-10T21:18:58.980Z","lastSignal":"2026-11-11T05:59:43.000Z","updated":"2026-11-11T15:44:07.320Z","revision":1,"life":[{"status":"Born","at":"2026-11-11T05:59:43.000Z","why":"second independent source: C31 Vulners (new public exploits)"},{"status":"Developing","at":"2026-11-11T05:59:43.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-10T21:18:58.980Z","what":"First signal: C6 NVD CVE API 2.0"},{"at":"2026-11-11T05:59:43.000Z","what":"Born: second source, C31 Vulners (new public exploits). Page EM-20261111-3565 created."}],"stages":[{"name":"Disclosed","at":"2026-11-10T21:18:58.980Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-10T21:18:58.980Z","detail":"CVSS 9.5"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-10T21:18:58.980Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":4,"title":"CVE-2026-118383 (CVSS 9.5)","text":"A use-after-free in the replication component of MongoDB Server can occur when a newly elected replica set primary completes catch-up. The condition can be caused by requests that do not require authentication, and may result in the server terminating unexpectedly or, under certain conditions, arbitrary code execution in the context of the server process. Replica set members are affected, including the shard and config server replica set members of sharded clusters; standalone mongod instances are not.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118383"},{"at":"2026-11-11T05:59:43.000Z","source":"C31","sourceName":"Vulners (new public exploits)","role":"Research & News","severity":3,"title":"Public exploit: Exploit for CVE-2026-118383","text":"# CVE-2026-118383 — MongoDB pre-auth use-after-free in primary catch-up\n\n| | |\n|---|---|\n| **CVE** | CVE-2026-118383 |\n| **Component** | MongoDB server, replication (`ReplicationCoordinatorImpl`) |\n| **Affected** | 8.0.x before 8.0.37 (8.0.34 tested); 8.2 builds before the backport (8.2.12 tested)…","url":"https://github.com/googlesky/CVE-2026-118383"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-10T21:18:58.980","score":9.5,"severity":"CRITICAL","desc":"A use-after-free in the replication component of MongoDB Server can occur when a newly elected replica set primary completes catch-up. The condition can be caused by requests that do not require authentication, and may result in the server terminating unexpectedly or, under certain conditions…","product":"","seen":1794357664905},"kev":null,"epss":null,"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}