# MongoDB Atlas in September 2026: incidents, uptime and changes

> MongoDB Atlas in September 2026: 4 incidents on its status page (2 major or critical), 95.77% free of major or critical incidents (vendor-reported), 71 CVEs. From Rewindex’s archive of MongoDB Atlas’s status, pricing and policy pages.

Canonical: https://rewindex.com/company/mongodb-atlas/2026/09
Last updated: 2026-10-01T00:00:00Z

- Incidents posted: 4 (major/critical: 2) · Maintenance: 0
- By vendor impact label: major 2, minor 1, none 1
- Uptime (vendor-reported): 95.77% free of major/critical incidents, 95.44% free of any incident; outage time 30 h 25 min, incident time 32 h 48 min
- Price changes: 0 · Pricing/legal/trust page changes: 0 · Deprecations: 0 · CVEs: 71
- Previous month: [August 2026](https://rewindex.com/company/mongodb-atlas/2026/08.md) · Next: [October 2026](https://rewindex.com/company/mongodb-atlas/2026/10.md) · [All months](https://rewindex.com/company/mongodb-atlas/reports.md) · [MongoDB Atlas](https://rewindex.com/company/mongodb-atlas.md)

_Uptime: Derived from the incidents the vendor posted on its own status page, not measured by us. A minute counts as an outage minute when a major or critical incident (as the vendor labelled it) was open; incident minutes include minor ones too. Maintenance and incidents marked "no impact" are left out, overlapping incidents are merged, a resolved incident counts for at most 7 days, and one still open with no resolution counts for at most 24 hours._

## Major and critical incidents

| Incident | Impact (vendor label) | Started (UTC) | Resolved (UTC) | Duration | Status |
| --- | --- | --- | --- | --- | --- |
| [Impaired Cluster operations in AWS me-central-1 and AWS me-south-1](https://rewindex.com/company/mongodb-atlas/incidents/yhvvsfvwyf1h.md) | major | 2026-09-03 16:44 UTC | not resolved | ongoing | monitoring |
| [Support Portal Outage](https://rewindex.com/company/mongodb-atlas/incidents/bm948zqk8djr.md) | major | 2026-09-16 09:06 UTC | 2026-09-16 15:31 UTC | 6.4 h | resolved |

## All incidents

| Incident | Impact (vendor label) | Started (UTC) | Resolved (UTC) | Duration | Status |
| --- | --- | --- | --- | --- | --- |
| [Impaired Cluster operations in AWS me-central-1 and AWS me-south-1](https://rewindex.com/company/mongodb-atlas/incidents/yhvvsfvwyf1h.md) | major | 2026-09-03 16:44 UTC | not resolved | ongoing | monitoring |
| [Atlas is experiencing issues with issuing certificates from Lets Encrypt](https://rewindex.com/company/mongodb-atlas/incidents/x8kqzkjlz8gd.md) | minor | 2026-09-11 01:28 UTC | 2026-09-11 03:51 UTC | 2.4 h | resolved |
| [Support Portal Outage](https://rewindex.com/company/mongodb-atlas/incidents/bm948zqk8djr.md) | major | 2026-09-16 09:06 UTC | 2026-09-16 15:31 UTC | 6.4 h | resolved |
| [Delays in Atlas cluster management operations](https://rewindex.com/company/mongodb-atlas/incidents/c82n77tbp85t.md) | none | 2026-09-30 18:51 UTC | 2026-09-30 21:02 UTC | 2.2 h | resolved |

## CVEs published

- [CVE-2026-84970](https://rewindex.com/cve/CVE-2026-84970.md) Heap over-read or silent misparse via 32-bit truncation of JSON length in BSON JSON parser (CVSS 6.2), published 2026-09-03
- [CVE-2026-84971](https://rewindex.com/cve/CVE-2026-84971.md) Persistent client crash loop via undersized FLE2 insert-update ciphertext in decryption path (CVSS 6.5), published 2026-09-03
- [CVE-2026-84969](https://rewindex.com/cve/CVE-2026-84969.md) Heap overflow via truncated base64 encoding of binary fields in length-limited JSON output (CVSS 3.7), published 2026-09-03
- [CVE-2026-84966](https://rewindex.com/cve/CVE-2026-84966.md) BSON element injection via NUL-embedded document keys in builder append (CVSS 5.1), published 2026-09-03
- [CVE-2026-84965](https://rewindex.com/cve/CVE-2026-84965.md) Heap write primitive via size round-up wrap during JSON parsing on 32-bit builds (CVSS 5.1), published 2026-09-03
- [CVE-2026-84964](https://rewindex.com/cve/CVE-2026-84964.md) Heap corruption via OCSP request double free from crafted multi-URL certificate in TLS client (CVSS 5.9), published 2026-09-03
- [CVE-2026-84963](https://rewindex.com/cve/CVE-2026-84963.md) Silent field truncation via unchecked int cast of huge JSON string values in JSON-to-BSON parser (CVSS 5.3), published 2026-09-03
- [CVE-2026-84962](https://rewindex.com/cve/CVE-2026-84962.md) Authenticated KMS request forgery via CRLF injection in GCP key identifier strings (CVSS 4.2), published 2026-09-03
- [CVE-2026-84967](https://rewindex.com/cve/CVE-2026-84967.md) Arbitrary command execution via shell-expanded connection string in Launch MongoDB Shell terminal (CVSS 4.3), published 2026-09-03
- [CVE-2026-84968](https://rewindex.com/cve/CVE-2026-84968.md) Heap out-of-bounds read via corrupt nested BSON in field path error message (CVSS 5.3), published 2026-09-03
- [CVE-2026-82052](https://rewindex.com/cve/CVE-2026-82052.md) $regexFindAll may crash mongod server when byte-matching multi-byte UTF-8 chars (CVSS 6.5), published 2026-09-08
- [CVE-2026-82053](https://rewindex.com/cve/CVE-2026-82053.md) Improper Session Handling in MongoDB Server LDAP Authorization Integration Leads to Incorrect Role Assignment (CVSS 8.1), published 2026-09-08
- [CVE-2026-82054](https://rewindex.com/cve/CVE-2026-82054.md) Uncontrolled Resource Consumption in MongoDB Server JSON Pointer Parser Leads to Denial of Service (CVSS 6.5), published 2026-09-08
- [CVE-2026-82055](https://rewindex.com/cve/CVE-2026-82055.md) Null Pointer Dereference in MongoDB Server 2dsphere Index Key Generation Leads to Denial of Service (CVSS 6.5), published 2026-09-08
- [CVE-2026-82056](https://rewindex.com/cve/CVE-2026-82056.md) Race Condition in MongoDB Server Text Index Query Parsing Leads to Heap Use-After-Free and Denial of Service (CVSS 5.3), published 2026-09-08
- [CVE-2026-82057](https://rewindex.com/cve/CVE-2026-82057.md) Type Confusion in MongoDB Server WiredTiger Storage Engine via Custom Collection Configuration Leads to Persistent Denial of Service (CVSS 6.5), published 2026-09-08
- [CVE-2026-82058](https://rewindex.com/cve/CVE-2026-82058.md) Unhandled Exception in MongoDB Server JSON Schema Validation Error Generation Leads to Denial of Service (CVSS 6.5), published 2026-09-08
- [CVE-2026-82059](https://rewindex.com/cve/CVE-2026-82059.md) Improper Access Restriction of Internal Aggregation Expression in MongoDB Server Leads to Assertion Failure and Denial of Service (CVSS 5.3), published 2026-09-08
- [CVE-2026-82060](https://rewindex.com/cve/CVE-2026-82060.md) Insufficient Validation of Shard Key Values in MongoDB Server Leads to Query Operator Injection in Change Stream Post-Image Lookups (CVSS 5.4), published 2026-09-08
- [CVE-2026-82061](https://rewindex.com/cve/CVE-2026-82061.md) Use-After-Free in MongoDB Server Query Execution Memory Tracking Subsystem Leads to Denial of Service (CVSS 8.1), published 2026-09-08
- [CVE-2026-82062](https://rewindex.com/cve/CVE-2026-82062.md) Improper Authorization in MongoDB Server applyOps Command Allows Writes to Arbitrary Internal Storage Tables via Feature Gate Bypass (CVSS 5.5), published 2026-09-08
- [CVE-2026-82063](https://rewindex.com/cve/CVE-2026-82063.md) Use-After-Free in MongoDB Server Cursor Management Component Leads to Denial of Service (CVSS 5.3), published 2026-09-08
- [CVE-2026-82064](https://rewindex.com/cve/CVE-2026-82064.md) Unauthenticated Denial of Service in MongoDB Server via Assertion Failure in Read Concern Processing on Replica Set Members (CVSS 7.5), published 2026-09-08
- [CVE-2026-82065](https://rewindex.com/cve/CVE-2026-82065.md) Insufficient Validation of Storage Configuration Options in MongoDB Server Leads to Persistent Denial of Service via Corrupted Metadata (CVSS 6.5), published 2026-09-08
- [CVE-2026-82066](https://rewindex.com/cve/CVE-2026-82066.md) Heap Out-of-Bounds Read in MongoDB Server Query Planning Component (CVSS 4.3), published 2026-09-08
- [CVE-2026-82067](https://rewindex.com/cve/CVE-2026-82067.md) Improper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause Authorization to Remain Disabled at Startup (CVSS 8.1), published 2026-09-08
- [CVE-2026-82068](https://rewindex.com/cve/CVE-2026-82068.md) Persistent Fatal Assertion Crash in MongoDB Server via Crafted Retryable Write Commands Leads to Denial of Service (CVSS 6.5), published 2026-09-08
- [CVE-2026-82069](https://rewindex.com/cve/CVE-2026-82069.md) Improper Redaction of Query Literals in MongoDB Server Query Statistics Serialization on Sharded Cluster Router (CVSS 2.7), published 2026-09-08
- [CVE-2026-82070](https://rewindex.com/cve/CVE-2026-82070.md) Insufficiently Protected Credentials in MongoDB Server Diagnostic Reporting Interface (CVSS 6.5), published 2026-09-08
- [CVE-2026-82071](https://rewindex.com/cve/CVE-2026-82071.md) Insufficient Validation of Storage Engine Configuration Options in MongoDB Server Leads to Out-of-Bounds Write (CVSS 8.1), published 2026-09-08
- [CVE-2026-82073](https://rewindex.com/cve/CVE-2026-82073.md) Improper Validation in MongoDB Server Aggregation Framework Allows Authorization Bypass and Unauthorized Collection Access with Atlas Search (CVSS 6.5), published 2026-09-08
- [CVE-2026-82074](https://rewindex.com/cve/CVE-2026-82074.md) Incorrect Authorization in MongoDB Server Aggregation Framework Allows Unauthorized Read Access to Collection Data (CVSS 6.5), published 2026-09-08
- [CVE-2026-82075](https://rewindex.com/cve/CVE-2026-82075.md) Uncontrolled Resource Consumption in MongoDB Sharded Cluster Router Allows Unauthenticated Denial of Service (CVSS 7.5), published 2026-09-08
- [CVE-2026-82076](https://rewindex.com/cve/CVE-2026-82076.md) Integer Overflow in Query Planner Leads to Unbounded Memory Allocation and Denial of Service in MongoDB Server (CVSS 6.5), published 2026-09-08
- [CVE-2026-88022](https://rewindex.com/cve/CVE-2026-88022.md) Unauthorized document disclosure and deletion via query-operator injection in explicit equality filters in MongoDB integration for Laravel (CVSS 7.7), published 2026-09-10
- [CVE-2026-88023](https://rewindex.com/cve/CVE-2026-88023.md) GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB PHP Library (CVSS 8.3), published 2026-09-10
- [CVE-2026-88024](https://rewindex.com/cve/CVE-2026-88024.md) GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Rust Driver (CVSS 8.3), published 2026-09-10
- [CVE-2026-88025](https://rewindex.com/cve/CVE-2026-88025.md) GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C\# Driver (CVSS 8.3), published 2026-09-10
- [CVE-2026-88026](https://rewindex.com/cve/CVE-2026-88026.md) Regular expression injection via unescaped characters in LINQ query translation in MongoDB C\# Driver (CVSS 6.5), published 2026-09-10
- [CVE-2026-88027](https://rewindex.com/cve/CVE-2026-88027.md) Mass deletion and overwrite of embedded documents via query-operator injection in embedded record keys in MongoDB integration for Laravel (CVSS 7.1), published 2026-09-10
- [CVE-2026-88028](https://rewindex.com/cve/CVE-2026-88028.md) Unauthorized document disclosure via query-operator injection in polymorphic relation identifiers in MongoDB integration for Laravel (CVSS 6.5), published 2026-09-10
- [CVE-2026-88029](https://rewindex.com/cve/CVE-2026-88029.md) GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Python Driver (CVSS 8.3), published 2026-09-10
- [CVE-2026-88030](https://rewindex.com/cve/CVE-2026-88030.md) GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Ruby Driver (CVSS 8.3), published 2026-09-10
- [CVE-2026-88031](https://rewindex.com/cve/CVE-2026-88031.md) GridFS data deletion via query-operator injection in file IDs in the MongoDB Go Driver (CVSS 8.1), published 2026-09-10
- [CVE-2026-88032](https://rewindex.com/cve/CVE-2026-88032.md) Application denial of service via cancellation race in reactive client-side encryption in MongoDB Java Driver (CVSS 5.9), published 2026-09-10
- [CVE-2026-88033](https://rewindex.com/cve/CVE-2026-88033.md) GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Java Driver (CVSS 8.3), published 2026-09-10
- [CVE-2026-88034](https://rewindex.com/cve/CVE-2026-88034.md) GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C++ Driver (CVSS 8.3), published 2026-09-10
- [CVE-2026-88035](https://rewindex.com/cve/CVE-2026-88035.md) Heap buffer overflow via wrapped size check during SASL username canonicalization in MongoDB C Driver (CVSS 4.7), published 2026-09-10
- [CVE-2026-88036](https://rewindex.com/cve/CVE-2026-88036.md) GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C Driver (CVSS 8.3), published 2026-09-10
- [CVE-2026-89099](https://rewindex.com/cve/CVE-2026-89099.md) Race Condition in MongoDB Server Document Value Layer Leads to Memory Corruption (CVSS 7.5), published 2026-09-11
- [CVE-2026-92756](https://rewindex.com/cve/CVE-2026-92756.md) Combining encryption settings may disable encryption (CVSS 5.5), published 2026-09-17
- [CVE-2026-92758](https://rewindex.com/cve/CVE-2026-92758.md) Logs may collect sensitive information (CVSS 5.5), published 2026-09-17
- [CVE-2026-92757](https://rewindex.com/cve/CVE-2026-92757.md) Malformed connection string may disable field level encryption (CVSS 5.5), published 2026-09-17
- [CVE-2026-93393](https://rewindex.com/cve/CVE-2026-93393.md) Heap overflow via oversized decrypted TLS record sequence in Windows Secure Channel stream (CVSS 8.1), published 2026-09-17
- [CVE-2026-93394](https://rewindex.com/cve/CVE-2026-93394.md) libmongoc SCRAM client nonce-validation bypass (CVSS 3.7), published 2026-09-17
- [CVE-2026-93395](https://rewindex.com/cve/CVE-2026-93395.md) Integer Underflow → Heap Out-of-Bounds Read in \`bson\_new\_from\_buffer() (CVSS 5.3), published 2026-09-17
- [CVE-2026-93758](https://rewindex.com/cve/CVE-2026-93758.md) Cross-principal document update, theft, and deletion via unvalidated id in nested attributes (CVSS 8.1), published 2026-09-18
- [CVE-2026-93765](https://rewindex.com/cve/CVE-2026-93765.md) Document deletion and process crash via unvalidated method-name dispatch in atomic pop operation (CVSS 9.1), published 2026-09-18
- [CVE-2026-93764](https://rewindex.com/cve/CVE-2026-93764.md) Plaintext storage of encrypted fields via skipped embedded models in encryption schema generation (CVSS 6.5), published 2026-09-18
- [CVE-2026-93763](https://rewindex.com/cve/CVE-2026-93763.md) Silent plaintext persistence via unresolved callable database name in encryption schema map (CVSS 6.5), published 2026-09-18
- [CVE-2026-93762](https://rewindex.com/cve/CVE-2026-93762.md) Data deletion and attribute disclosure via field-name method injection in in-memory queries (CVSS 9.8), published 2026-09-18
- [CVE-2026-93761](https://rewindex.com/cve/CVE-2026-93761.md) Denial of service via unbounded regex matching in Mongoid's in-memory query matcher (CVSS 7.5), published 2026-09-18
- [CVE-2026-93760](https://rewindex.com/cve/CVE-2026-93760.md) NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guard (CVSS 8.2), published 2026-09-18
- [CVE-2026-93759](https://rewindex.com/cve/CVE-2026-93759.md) Server-side JavaScript injection via string query criteria bypassing the strict operator allowlist (CVSS 8.6), published 2026-09-18
- [CVE-2026-96744](https://rewindex.com/cve/CVE-2026-96744.md) Unauthorized cache lock takeover via expression injection in lock owner values in MongoDB integration for Laravel (CVSS 7.1), published 2026-09-24
- [CVE-2026-96750](https://rewindex.com/cve/CVE-2026-96750.md) Shell script injection via server-supplied database name in Open MongoDB shell (CVSS 7.1), published 2026-09-24
- [CVE-2026-96746](https://rewindex.com/cve/CVE-2026-96746.md) Heap buffer overflow via mid-scan command list growth in client topology monitoring (CVSS 6.5), published 2026-09-24
- [CVE-2026-96745](https://rewindex.com/cve/CVE-2026-96745.md) PHP object injection via unsuppressible \_\_pclass class inference in command monitoring events (CVSS 5.6), published 2026-09-24
- [CVE-2026-96747](https://rewindex.com/cve/CVE-2026-96747.md) Forced local Unix socket connection via dot-sock KMS endpoint in client-side field encryption (CVSS 5.0), published 2026-09-24
- [CVE-2026-96748](https://rewindex.com/cve/CVE-2026-96748.md) Connection redirection via percent-encoded delimiter injection in connection string hosts (CVSS 6.5), published 2026-09-24
- [CVE-2026-96749](https://rewindex.com/cve/CVE-2026-96749.md) Heap out-of-bounds write via signed size overflow in BSON document encoding (CVSS 8.4), published 2026-09-24

## Cite this

MongoDB Atlas posted 4 status incidents in September 2026 (2 major or critical); 0 price changes and 0 notable page changes observed.

- Canonical URL: https://rewindex.com/company/mongodb-atlas/2026/09
- Citation: MongoDB Atlas, “MongoDB Atlas in September 2026” (2026-09-01 00:00 UTC). Archived by Rewindex: https://rewindex.com/company/mongodb-atlas/2026/09 (CC BY 4.0).
- Markdown link: `[MongoDB Atlas: MongoDB Atlas in September 2026 (2026-09-01)](https://rewindex.com/company/mongodb-atlas/2026/09)`


---
Canonical: https://rewindex.com/company/mongodb-atlas/2026/09 · Markdown: https://rewindex.com/company/mongodb-atlas/2026/09.md · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-11-05T14:11:16.939Z