---
title: MongoDB Server Oct 13 patches: five CVEs (RCE/DoS); CERT-FR CERTFR-2026-AVI-1304 | ctxsec
url: https://ctxsec.com/items/mongodb-oct-2026-server-cves
description: ""
status: "confirmed (vendor + CERT-FR); no known exploitation stated"
published: 2026-10-14
---

> 

[← Cybersecurity News](/news) · [markdown](/items/mongodb-oct-2026-server-cves.md)

confirmed (vendor + CERT-FR); no known exploitation stated

2026-10-14

### MongoDB Server Oct 13 patches: five CVEs (RCE/DoS); CERT-FR CERTFR-2026-AVI-1304

MongoDB released 8.0.34 on Oct 13 with fixes for CVE-2026-96297, CVE-2026-103965, and CVE-2026-104004 (related JIRAs include SERVER-132946 heap-use-after-free in $_internalApplyOplogUpdate, SERVER-134618 $bucket serialization, SERVER-131412 validation). CERT-FR advisory CERTFR-2026-AVI-1304 (Oct 14) also lists CVE-2026-104005 and CVE-2026-96299 and says the flaws can enable remote code execution and/or remote denial of service. Affected trains per CERT-FR: 7.x before 7.0.45, 8.0.x before 8.0.34, 8.3.x before 8.3.13, plus 9.0/9.1 release candidates below the named RCs. Upgrade to the fixed patch lines from MongoDB; Atlas customers should confirm auto-upgrade settings. Not on CISA KEV as of catalogVersion 2026.10.14.

Sources: [CERTFR-2026-AVI-1304](https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1304/) · [MongoDB 8.0.34 release notes](https://www.mongodb.com/docs/manual/release-notes/8.0/#8.0.34---oct-13--2026) · [CVE-2026-103965](https://www.cve.org/CVERecord?id=CVE-2026-103965)