July 2026 Security Release

At MongoDB, security is our top priority. Our security team continuously monitors for, and addresses, potential vulnerabilities and attempted misuse to ensure the integrity and safety of your environments. Below, we first share what you need to know to enhance your protection of your use of MongoDB products. We also explain how MongoDB thinks about patching predictability and security.

Today, we’re providing a set of updates that address 25 CVEs in MongoDB Server and 1 CVE in MongoDB Compass. MongoDB server customers should update to the latest release (MongoDB Server versions 8.3.7, 8.0.28, 7.0.39, and Compass version 1.49.7) that address each of the security advisories (“CVEs”) issued on the 21st of July.

There are no additional actions that need to be taken beyond patching.

We recommend that all customers upgrade to a supported patched release:

As with any security patch, customers should consider their specific environment, access controls, and risk posture when assessing potential impact and deciding how quickly to apply these patches.

The action requested here is part of MongoDB's commitment to continuously improve our software and protect our customers.

The following are the security advisories (CVEs) included in the July 21st MongoDB Server and MongoDB Compass releases. Each is denoted with their “CVSS” score; please see our advice about CVSS scores.

We have heard two messages clearly from customers as we, and the industry, increase our rate of security fixes in the Age of AI: (1) please make it easy for me to patch, and (2) please get security fixes out to me quickly. The 26 security fixes released on July 21st are part of our new, predictable cadence to release security fixes on a monthly basis.

When we need to urgently release a new version of MongoDB Server, we use well-practiced standard operating procedures to release minimalist changes (minimizing the number of changes over the software that customers are already using in Atlas or on-premises) that are thoroughly tested and carefully reviewed.

When we create our release plans, we are working backwards from the Atlas and MongoDB Enterprise Advanced customer experiences of having these patches land in your software stack. Not all security fixes are urgent (in fact, most are not) so we batch them up whenever the security and operational risk assessments support batching (hence the batch in the July 21st release). When the security risk is sufficiently high, we have demonstrated our commitment to moving quickly to protect customers (i.e., the June 11th release).

MongoDB Enterprise Advanced customers with robust internal automation, testing, and qualification are finding it straightforward to adapt to the increasing rate of security fixes in the industry. In Atlas, MongoDB takes care of the MongoDB Server deployments for you, minimizing the amount customers need to think about patching.

MongoDB is dedicated to protecting your data and ensuring the reliability of our services. We will continue to adopt the latest security and AI-based techniques to further harden our products. We thank you for your continued trust.