Percona has disclosed two high-severity CVEs affecting Percona Server for MongoDB and upstream MongoDB Community. CVE-2026-9740 (CVSS 8.7) is a pre-authenticated stack overflow in the BSON validator's BSONColumn interleaved-reference handling — no credentials required, just network access to mongod. CVE-2026-11933 (CVSS 8.8) is a use-after-free in the server-side JavaScript engine's BSON-to-array conversion, reachable via $where, $function, $accumulator, mapReduce, or system.js. A mitigation for CVE-2026-11933 exists: disable server-side JavaScript via --noscripting or security.javascriptEnabled: false. CVE-2026-9740 has no off-switch — only patching and network controls help. Coordinated patch releases targeting all supported major versions (7.0 and 8.0) are expected the week of June 17, 2026. Percona will not build binary packages for the 5.x line. Kubernetes users running the Percona Operator for MongoDB should update the image tag directly without waiting for an operator release.
