# MongoDB Atlas in October 2026: incidents, uptime and changes

> MongoDB Atlas in October 2026: 5 incidents on its status page (2 major or critical), 99.05% free of major or critical incidents (vendor-reported), 1 pricing/legal/trust page change, 42 CVEs. From Rewindex’s archive of MongoDB Atlas’s status, pricing and policy pages.

Canonical: https://rewindex.com/company/mongodb-atlas/2026/10
Last updated: 2026-11-02T20:17:32Z

- Incidents posted: 5 (major/critical: 2) · Maintenance: 0
- By vendor impact label: major 2, minor 2, none 1
- Uptime (vendor-reported): 99.05% free of major/critical incidents, 96.69% free of any incident; outage time 7 h 1 min, incident time 24 h 37 min
- Price changes: 0 · Pricing/legal/trust page changes: 1 · Deprecations: 0 · CVEs: 42
- Previous month: [September 2026](https://rewindex.com/company/mongodb-atlas/2026/09.md) · Next: [November 2026](https://rewindex.com/company/mongodb-atlas/2026/11.md) · [All months](https://rewindex.com/company/mongodb-atlas/reports.md) · [MongoDB Atlas](https://rewindex.com/company/mongodb-atlas.md)

_Uptime: Derived from the incidents the vendor posted on its own status page, not measured by us. A minute counts as an outage minute when a major or critical incident (as the vendor labelled it) was open; incident minutes include minor ones too. Maintenance and incidents marked "no impact" are left out, overlapping incidents are merged, a resolved incident counts for at most 7 days, and one still open with no resolution counts for at most 24 hours._

## Major and critical incidents

| Incident | Impact (vendor label) | Started (UTC) | Resolved (UTC) | Duration | Status |
| --- | --- | --- | --- | --- | --- |
| [Trigger processing may be delayed globally](https://rewindex.com/company/mongodb-atlas/incidents/5swmlx3k589x.md) | major | 2026-10-01 15:41 UTC | 2026-10-01 20:54 UTC | 5.2 h | resolved |
| [Issue impacting Atlas Search availability on certain clusters](https://rewindex.com/company/mongodb-atlas/incidents/279h4bcrcrlr.md) | major | 2026-10-09 16:29 UTC | 2026-10-09 18:17 UTC | 1.8 h | resolved |

## All incidents

| Incident | Impact (vendor label) | Started (UTC) | Resolved (UTC) | Duration | Status |
| --- | --- | --- | --- | --- | --- |
| [Trigger processing may be delayed globally](https://rewindex.com/company/mongodb-atlas/incidents/5swmlx3k589x.md) | major | 2026-10-01 15:41 UTC | 2026-10-01 20:54 UTC | 5.2 h | resolved |
| [MongoDB Charts: Infinite login loop when creating new Charts projects](https://rewindex.com/company/mongodb-atlas/incidents/y5cmsx7nwwg3.md) | minor | 2026-10-02 00:01 UTC | 2026-10-02 05:02 UTC | 5.0 h | resolved |
| [Admin Admin API: Intermittent Increase in 5xx errors](https://rewindex.com/company/mongodb-atlas/incidents/zgrbbkk36076.md) | none | 2026-10-09 13:11 UTC | 2026-10-09 15:46 UTC | 2.6 h | resolved |
| [Issue impacting Atlas Search availability on certain clusters](https://rewindex.com/company/mongodb-atlas/incidents/279h4bcrcrlr.md) | major | 2026-10-09 16:29 UTC | 2026-10-09 18:17 UTC | 1.8 h | resolved |
| [GCP Availability Zone europe-west2-b connectivity issues](https://rewindex.com/company/mongodb-atlas/incidents/v2d572p364wf.md) | minor | 2026-10-20 07:32 UTC | 2026-10-20 20:09 UTC | 13 h | resolved |

## Pricing, legal and trust page changes

- 2026-10-29 08:45 UTC: [Trust page changed](https://rewindex.com/change/p10362.md) (Trust / security: Trust page)

## CVEs published

- [CVE-2026-103546](https://rewindex.com/cve/CVE-2026-103546.md) Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator (CVSS 4.3), published 2026-10-05
- [CVE-2026-106428](https://rewindex.com/cve/CVE-2026-106428.md) Out-of-bounds read in SCRAM response parsing in MongoDB C Driver (CVSS 3.7), published 2026-10-08
- [CVE-2026-106431](https://rewindex.com/cve/CVE-2026-106431.md) One-byte heap buffer overflow in BSON bulk document writer in MongoDB C Driver (CVSS 5.7), published 2026-10-08
- [CVE-2026-106437](https://rewindex.com/cve/CVE-2026-106437.md) Out-of-bounds read and write via undersized BSON buffer reservation in MongoDB C Driver (CVSS 6.2), published 2026-10-08
- [CVE-2026-106438](https://rewindex.com/cve/CVE-2026-106438.md) Silent Decimal128 value corruption via incorrect exactness check in MongoDB C Driver (CVSS 4.0), published 2026-10-08
- [CVE-2026-106430](https://rewindex.com/cve/CVE-2026-106430.md) Query and rename target confusion via embedded NUL truncation in MongoDB C++ Driver (CVSS 5.9), published 2026-10-08
- [CVE-2026-106429](https://rewindex.com/cve/CVE-2026-106429.md) Application denial of service via malformed KMS endpoint in MongoDB libmongocrypt (CVSS 6.5), published 2026-10-08
- [CVE-2026-106433](https://rewindex.com/cve/CVE-2026-106433.md) Heap corruption via duplicate masterKey fields in MongoDB libmongocrypt (CVSS 8.8), published 2026-10-08
- [CVE-2026-106434](https://rewindex.com/cve/CVE-2026-106434.md) Unrecognized payload acceptance in explicit decryption in MongoDB libmongocrypt (CVSS 4.3), published 2026-10-08
- [CVE-2026-107324](https://rewindex.com/cve/CVE-2026-107324.md) Application denial of service via integer overflow in BSON value-length validation in MongoDB Go Driver (CVSS 5.9), published 2026-10-08
- [CVE-2026-107325](https://rewindex.com/cve/CVE-2026-107325.md) Application denial of service via missing BSON array length validation in MongoDB Go Driver (CVSS 5.9), published 2026-10-08
- [CVE-2026-106432](https://rewindex.com/cve/CVE-2026-106432.md) Heap buffer overflow via 32-bit string-length truncation in MongoDB PHP Driver (CVSS 3.6), published 2026-10-08
- [CVE-2026-106436](https://rewindex.com/cve/CVE-2026-106436.md) Application denial of service and data truncation via unchecked BSON append failures in MongoDB PHP Driver (CVSS 4.8), published 2026-10-08
- [CVE-2026-106435](https://rewindex.com/cve/CVE-2026-106435.md) Application denial of service via out-of-bounds read in BSON Regex decoding in MongoDB Python Driver (CVSS 5.1), published 2026-10-08
- [CVE-2026-87110](https://rewindex.com/cve/CVE-2026-87110.md) Ops Manager Uncontrolled Resource Consumption in Monitoring Endpoints (CVSS 5.3), published 2026-10-09
- [CVE-2026-87108](https://rewindex.com/cve/CVE-2026-87108.md) Ops Manager Improper Authorization in Daily Host Monitoring Retrieval (CVSS 3.1), published 2026-10-09
- [CVE-2026-87109](https://rewindex.com/cve/CVE-2026-87109.md) Ops Manager Sensitive MFA Enrollment Information Exposure in User Listings (CVSS 5.3), published 2026-10-09
- [CVE-2026-96297](https://rewindex.com/cve/CVE-2026-96297.md) MongoDB Server may disclose process memory via a crafted \`$\_internalApplyOplogUpdate\` aggregation pipeline (CVSS 6.5), published 2026-10-13
- [CVE-2026-96299](https://rewindex.com/cve/CVE-2026-96299.md) Missing Authorization Check on Internal Aggregation Stage in MongoDB Server mongos Leads to Denial of Service (CVSS 6.5), published 2026-10-13
- [CVE-2026-103965](https://rewindex.com/cve/CVE-2026-103965.md) Fixed values in MongoDB Server $bucket stage may be misread as field references (CVSS 5.4), published 2026-10-13
- [CVE-2026-104004](https://rewindex.com/cve/CVE-2026-104004.md) Collection validators using collation-accepting expressions can crash MongoDB Server on insert (CVSS 6.5), published 2026-10-13
- [CVE-2026-104005](https://rewindex.com/cve/CVE-2026-104005.md) Incorrect authorization in MongoDB Server router for bulk writes to system namespaces (CVSS 6.5), published 2026-10-13
- [CVE-2026-112368](https://rewindex.com/cve/CVE-2026-112368.md) Unbounded Recursion in phongo\_bson\_visit\_document/visit\_array: (CVSS 7.5), published 2026-10-19
- [CVE-2026-113870](https://rewindex.com/cve/CVE-2026-113870.md) Improper Encoding of Server-Supplied JavaScript Values in MongoDB Compass BSON Parsing (CVSS 8.8), published 2026-10-21
- [CVE-2026-114643](https://rewindex.com/cve/CVE-2026-114643.md) Duplicate geometry fields via unvalidated GeoJSON extra members (CVSS 5.4), published 2026-10-22
- [CVE-2026-114644](https://rewindex.com/cve/CVE-2026-114644.md) Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserialization (CVSS 5.9), published 2026-10-22
- [CVE-2026-114645](https://rewindex.com/cve/CVE-2026-114645.md) Heap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message wrapping (CVSS 5.2), published 2026-10-22
- [CVE-2026-114646](https://rewindex.com/cve/CVE-2026-114646.md) NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wire (CVSS 6.5), published 2026-10-22
- [CVE-2026-114647](https://rewindex.com/cve/CVE-2026-114647.md) NoSQL operator injection via unvalidated replacement document in findOneAndReplace (CVSS 4.3), published 2026-10-22
- [CVE-2026-114648](https://rewindex.com/cve/CVE-2026-114648.md) NoSQL injection via dot and dollar characters in LINQ filter field names and dictionary keys (CVSS 7.6), published 2026-10-22
- [CVE-2026-114649](https://rewindex.com/cve/CVE-2026-114649.md) Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache (CVSS 6.8), published 2026-10-22
- [CVE-2026-114650](https://rewindex.com/cve/CVE-2026-114650.md) Plaintext exposure of encrypted fields via ANSI code-page corruption of database name (CVSS 5.9), published 2026-10-22
- [CVE-2026-114651](https://rewindex.com/cve/CVE-2026-114651.md) Cross-document data leak via malformed BSON array parsing in reused thread buffer (CVSS 4.0), published 2026-10-22
- [CVE-2026-114652](https://rewindex.com/cve/CVE-2026-114652.md) Update operator injection via single-element list rewriting in the update builder (CVSS 6.5), published 2026-10-22
- [CVE-2026-114653](https://rewindex.com/cve/CVE-2026-114653.md) Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builder (CVSS 6.5), published 2026-10-22
- [CVE-2026-114654](https://rewindex.com/cve/CVE-2026-114654.md) BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guards (CVSS 6.5), published 2026-10-22
- [CVE-2026-114655](https://rewindex.com/cve/CVE-2026-114655.md) KMS request injection via unsanitized key vault and provider values in libmongocrypt (CVSS 5.9), published 2026-10-22
- [CVE-2026-115929](https://rewindex.com/cve/CVE-2026-115929.md) MongoDB Compass trusts certificates issued by recoverable eMudhra intermediate CAs (CVSS 6.8), published 2026-10-24
- [CVE-2026-115930](https://rewindex.com/cve/CVE-2026-115930.md) MongoDB Shell (mongosh) bundled with Node.js trusts certificates issued by recoverable eMudhra intermediate CAs (CVSS 6.8), published 2026-10-26
- [CVE-2026-118510](https://rewindex.com/cve/CVE-2026-118510.md) Laravel MongoDB \`whereDoesntHave\` misses deny records for numeric string IDs (CVSS 8.8), published 2026-10-28
- [CVE-2026-118581](https://rewindex.com/cve/CVE-2026-118581.md) NoSQL injection via mismatched BSON size prefix in raw document splice to the wire protocol (CVSS 6.5), published 2026-10-28
- [CVE-2026-116641](https://rewindex.com/cve/CVE-2026-116641.md) The DB Tools trust certificates issued by recoverable eMudhra intermediate CAs (CVSS 6.8), published 2026-10-28

## Cite this

MongoDB Atlas posted 5 status incidents in October 2026 (2 major or critical); 0 price changes and 1 notable page change observed.

- Canonical URL: https://rewindex.com/company/mongodb-atlas/2026/10
- Citation: MongoDB Atlas, “MongoDB Atlas in October 2026” (2026-10-01 00:00 UTC). Archived by Rewindex: https://rewindex.com/company/mongodb-atlas/2026/10 (CC BY 4.0).
- Markdown link: `[MongoDB Atlas: MongoDB Atlas in October 2026 (2026-10-01)](https://rewindex.com/company/mongodb-atlas/2026/10)`


---
Canonical: https://rewindex.com/company/mongodb-atlas/2026/10 · Markdown: https://rewindex.com/company/mongodb-atlas/2026/10.md · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-11-04T11:10:17.479Z