CompaniesMongoDB AtlasMonthly reportsSeptember 2026
MongoDB Atlas in September 2026: incidents, uptime and changes
4incidents posted
2labelled major or critical
95.77%free of major/critical
95.44%free of any incident
0price changes
0notable page changes
Vendor-reported outage time 30 h 25 min, incident time 32 h 48 min. Derived from the incidents the vendor posted on its own status page, not measured by us. A minute counts as an outage minute when a major or critical incident (as the vendor labelled it) was open; incident minutes include minor ones too. Maintenance and incidents marked "no impact" are left out, overlapping incidents are merged, a resolved incident counts for at most 7 days, and one still open with no resolution counts for at most 24 hours. Last 90 days.
By vendor label: Major 2 · Minor 1 · No impact listed 1
Major and critical incidents 2
| Incident | Impact | Started | Duration | Status | Day |
|---|---|---|---|---|---|
| Impaired Cluster operations in AWS me-central-1 and AWS me-south-1 | Major | not resolved | monitoring | 09-03 | |
| Support Portal Outage | Major | 6.4 h | resolved | 09-16 |
Other incidents 2
| Incident | Impact | Started | Duration | Status | Day |
|---|---|---|---|---|---|
| Atlas is experiencing issues with issuing certificates from Lets Encrypt | Minor | 2.4 h | resolved | 09-11 | |
| Delays in Atlas cluster management operations | No impact listed | 2.2 h | resolved | 09-30 |
CVEs published
- CVE-2026-84970 Heap over-read or silent misparse via 32-bit truncation of JSON length in BSON JSON parser (CVSS 6.2)
- CVE-2026-84971 Persistent client crash loop via undersized FLE2 insert-update ciphertext in decryption path (CVSS 6.5)
- CVE-2026-84969 Heap overflow via truncated base64 encoding of binary fields in length-limited JSON output (CVSS 3.7)
- CVE-2026-84966 BSON element injection via NUL-embedded document keys in builder append (CVSS 5.1)
- CVE-2026-84965 Heap write primitive via size round-up wrap during JSON parsing on 32-bit builds (CVSS 5.1)
- CVE-2026-84964 Heap corruption via OCSP request double free from crafted multi-URL certificate in TLS client (CVSS 5.9)
- CVE-2026-84963 Silent field truncation via unchecked int cast of huge JSON string values in JSON-to-BSON parser (CVSS 5.3)
- CVE-2026-84962 Authenticated KMS request forgery via CRLF injection in GCP key identifier strings (CVSS 4.2)
- CVE-2026-84967 Arbitrary command execution via shell-expanded connection string in Launch MongoDB Shell terminal (CVSS 4.3)
- CVE-2026-84968 Heap out-of-bounds read via corrupt nested BSON in field path error message (CVSS 5.3)
- CVE-2026-82052 $regexFindAll may crash mongod server when byte-matching multi-byte UTF-8 chars (CVSS 6.5)
- CVE-2026-82053 Improper Session Handling in MongoDB Server LDAP Authorization Integration Leads to Incorrect Role Assignment (CVSS 8.1)
- CVE-2026-82054 Uncontrolled Resource Consumption in MongoDB Server JSON Pointer Parser Leads to Denial of Service (CVSS 6.5)
- CVE-2026-82055 Null Pointer Dereference in MongoDB Server 2dsphere Index Key Generation Leads to Denial of Service (CVSS 6.5)
- CVE-2026-82056 Race Condition in MongoDB Server Text Index Query Parsing Leads to Heap Use-After-Free and Denial of Service (CVSS 5.3)
- CVE-2026-82057 Type Confusion in MongoDB Server WiredTiger Storage Engine via Custom Collection Configuration Leads to Persistent Denial of Service (CVSS 6.5)
- CVE-2026-82058 Unhandled Exception in MongoDB Server JSON Schema Validation Error Generation Leads to Denial of Service (CVSS 6.5)
- CVE-2026-82059 Improper Access Restriction of Internal Aggregation Expression in MongoDB Server Leads to Assertion Failure and Denial of Service (CVSS 5.3)
- CVE-2026-82060 Insufficient Validation of Shard Key Values in MongoDB Server Leads to Query Operator Injection in Change Stream Post-Image Lookups (CVSS 5.4)
- CVE-2026-82061 Use-After-Free in MongoDB Server Query Execution Memory Tracking Subsystem Leads to Denial of Service (CVSS 8.1)
- CVE-2026-82062 Improper Authorization in MongoDB Server applyOps Command Allows Writes to Arbitrary Internal Storage Tables via Feature Gate Bypass (CVSS 5.5)
- CVE-2026-82063 Use-After-Free in MongoDB Server Cursor Management Component Leads to Denial of Service (CVSS 5.3)
- CVE-2026-82064 Unauthenticated Denial of Service in MongoDB Server via Assertion Failure in Read Concern Processing on Replica Set Members (CVSS 7.5)
- CVE-2026-82065 Insufficient Validation of Storage Configuration Options in MongoDB Server Leads to Persistent Denial of Service via Corrupted Metadata (CVSS 6.5)
- CVE-2026-82066 Heap Out-of-Bounds Read in MongoDB Server Query Planning Component (CVSS 4.3)
- CVE-2026-82067 Improper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause Authorization to Remain Disabled at Startup (CVSS 8.1)
- CVE-2026-82068 Persistent Fatal Assertion Crash in MongoDB Server via Crafted Retryable Write Commands Leads to Denial of Service (CVSS 6.5)
- CVE-2026-82069 Improper Redaction of Query Literals in MongoDB Server Query Statistics Serialization on Sharded Cluster Router (CVSS 2.7)
- CVE-2026-82070 Insufficiently Protected Credentials in MongoDB Server Diagnostic Reporting Interface (CVSS 6.5)
- CVE-2026-82071 Insufficient Validation of Storage Engine Configuration Options in MongoDB Server Leads to Out-of-Bounds Write (CVSS 8.1)
- CVE-2026-82073 Improper Validation in MongoDB Server Aggregation Framework Allows Authorization Bypass and Unauthorized Collection Access with Atlas Search (CVSS 6.5)
- CVE-2026-82074 Incorrect Authorization in MongoDB Server Aggregation Framework Allows Unauthorized Read Access to Collection Data (CVSS 6.5)
- CVE-2026-82075 Uncontrolled Resource Consumption in MongoDB Sharded Cluster Router Allows Unauthenticated Denial of Service (CVSS 7.5)
- CVE-2026-82076 Integer Overflow in Query Planner Leads to Unbounded Memory Allocation and Denial of Service in MongoDB Server (CVSS 6.5)
- CVE-2026-88022 Unauthorized document disclosure and deletion via query-operator injection in explicit equality filters in MongoDB integration for Laravel (CVSS 7.7)
- CVE-2026-88023 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB PHP Library (CVSS 8.3)
- CVE-2026-88024 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Rust Driver (CVSS 8.3)
- CVE-2026-88025 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C# Driver (CVSS 8.3)
- CVE-2026-88026 Regular expression injection via unescaped characters in LINQ query translation in MongoDB C# Driver (CVSS 6.5)
- CVE-2026-88027 Mass deletion and overwrite of embedded documents via query-operator injection in embedded record keys in MongoDB integration for Laravel (CVSS 7.1)
- CVE-2026-88028 Unauthorized document disclosure via query-operator injection in polymorphic relation identifiers in MongoDB integration for Laravel (CVSS 6.5)
- CVE-2026-88029 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Python Driver (CVSS 8.3)
- CVE-2026-88030 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Ruby Driver (CVSS 8.3)
- CVE-2026-88031 GridFS data deletion via query-operator injection in file IDs in the MongoDB Go Driver (CVSS 8.1)
- CVE-2026-88032 Application denial of service via cancellation race in reactive client-side encryption in MongoDB Java Driver (CVSS 5.9)
- CVE-2026-88033 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Java Driver (CVSS 8.3)
- CVE-2026-88034 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C++ Driver (CVSS 8.3)
- CVE-2026-88035 Heap buffer overflow via wrapped size check during SASL username canonicalization in MongoDB C Driver (CVSS 4.7)
- CVE-2026-88036 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C Driver (CVSS 8.3)
- CVE-2026-89099 Race Condition in MongoDB Server Document Value Layer Leads to Memory Corruption (CVSS 7.5)
- CVE-2026-92756 Combining encryption settings may disable encryption (CVSS 5.5)
- CVE-2026-92758 Logs may collect sensitive information (CVSS 5.5)
- CVE-2026-92757 Malformed connection string may disable field level encryption (CVSS 5.5)
- CVE-2026-93393 Heap overflow via oversized decrypted TLS record sequence in Windows Secure Channel stream (CVSS 8.1)
- CVE-2026-93394 libmongoc SCRAM client nonce-validation bypass (CVSS 3.7)
- CVE-2026-93395 Integer Underflow → Heap Out-of-Bounds Read in `bson_new_from_buffer() (CVSS 5.3)
- CVE-2026-93758 Cross-principal document update, theft, and deletion via unvalidated id in nested attributes (CVSS 8.1)
- CVE-2026-93765 Document deletion and process crash via unvalidated method-name dispatch in atomic pop operation (CVSS 9.1)
- CVE-2026-93764 Plaintext storage of encrypted fields via skipped embedded models in encryption schema generation (CVSS 6.5)
- CVE-2026-93763 Silent plaintext persistence via unresolved callable database name in encryption schema map (CVSS 6.5)
- CVE-2026-93762 Data deletion and attribute disclosure via field-name method injection in in-memory queries (CVSS 9.8)
- CVE-2026-93761 Denial of service via unbounded regex matching in Mongoid's in-memory query matcher (CVSS 7.5)
- CVE-2026-93760 NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guard (CVSS 8.2)
- CVE-2026-93759 Server-side JavaScript injection via string query criteria bypassing the strict operator allowlist (CVSS 8.6)
- CVE-2026-96744 Unauthorized cache lock takeover via expression injection in lock owner values in MongoDB integration for Laravel (CVSS 7.1)
- CVE-2026-96750 Shell script injection via server-supplied database name in Open MongoDB shell (CVSS 7.1)
- CVE-2026-96746 Heap buffer overflow via mid-scan command list growth in client topology monitoring (CVSS 6.5)
- CVE-2026-96745 PHP object injection via unsuppressible __pclass class inference in command monitoring events (CVSS 5.6)
- CVE-2026-96747 Forced local Unix socket connection via dot-sock KMS endpoint in client-side field encryption (CVSS 5.0)
- CVE-2026-96748 Connection redirection via percent-encoded delimiter injection in connection string hosts (CVSS 6.5)
- CVE-2026-96749 Heap out-of-bounds write via signed size overflow in BSON document encoding (CVSS 8.4)
Cite this
MongoDB Atlas posted 4 status incidents in September 2026 (2 major or critical); 0 price changes and 0 notable page changes observed.
- Title
- MongoDB Atlas in September 2026
- Vendor
- MongoDB Atlas
- Date
- URL
- https://rewindex.com/company/mongodb-atlas/2026/09