CVE-2026-13065: A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod
A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to terminate abnormally, resulting in denial of service. The issue stems from insufficient validation of sort specifications during execution.
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-13065
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-130650.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 23% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-13065 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- unknownMongoDB Multiple Vulnerabilitieshkcert
- unknownMultiple vulnerabilities in MongoDB (July 24, 2026)cert-fr-avis
- high[NEW] [high] MongoDB: Multiple vulnerabilitiescert-bund
Recent advisories for A user with
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- highCVE-2026-67352: luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_…nvd · 2026-08-01
- highCVE-2026-67343: ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the GET /api/v1/s…nvd · 2026-08-01
- lowCVE-2026-67334: better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admi…nvd · 2026-08-01
- highCVE-2026-67331: better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM pr…nvd · 2026-08-01
- highCVE-2026-67328: @better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities…nvd · 2026-08-01
- mediumCVE-2026-16684: The Easy Property Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting v…nvd · 2026-08-01
More from NVD Recent CVEs
- mediumCVE-2026-67355: guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the …2026-08-01
- mediumCVE-2026-67354: guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in Re…2026-08-01
- mediumCVE-2026-67353: guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the Cook…2026-08-01
- highCVE-2026-67352: luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_…2026-08-01
- mediumCVE-2026-67344: ArcadeDB before 26.7.2 fails to enforce the UPDATE_SCHEMA database permission on the ALTER TYP…2026-08-01