This vulnerability (CVE-2026-18697) in MongoDB Server involves a reachable assertion failure in the aggregation framework. An unauthenticated attacker can exploit this by sending a specially formed aggregation command to a mongos router process, causing it to crash. This leads to denial of service by interrupting client connections that rely on the affected mongos instance. The CVSS 4.0 score is 8.7 (high severity), reflecting network attack vector, no privileges or user interaction required, and high impact on availability. The affected versions are exactly 7.0, 8.0, and 8.3.0. There is no vendor advisory or patch information available at this time.

Successful exploitation causes the mongos router process to terminate unexpectedly, resulting in denial of service and disruption of client connections routed through the affected instance. There is no indication of data compromise or privilege escalation. The attack requires no authentication and can be performed remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider limiting network exposure of mongos instances and monitoring for abnormal process terminations. No official remediation or temporary fix has been published by the vendor at this time.