Inventory self-hosted mongod/mongos versions and jump to 7.0.45, 8.0.34, 8.3.13, or the fixed 9.x line from MongoDB—do not stay on RCs CERT-FR still lists as vulnerable. On replica sets, rolling-upgrade secondaries first; on sharded clusters, follow MongoDB's upgrade order for config servers and mongos. Confirm Atlas projects are on a patched patch-line if you are not on auto Latest Release. After upgrade, watch for unusual aggregation shapes that historically hit query-engine memory bugs, and keep authentication + network exposure controls in place (these CVEs are not an excuse to delay that hygiene).