This vulnerability (CVE-2026-9746) in MongoDB Server arises from a reachable assertion failure (CWE-617) when a logged-in user issues a statement using $changestreams combined with $_requestReshardingResumeToken and the exchange option. The assertion failure causes the server to crash, resulting in a denial of service. The vulnerability affects multiple recent versions of MongoDB Server, specifically 7.0.0, 8.0.0, 8.2.0, and 8.3.0. There is no indication of privilege escalation or data compromise beyond the denial of service. The CVSS 4.0 base score is 7.1, reflecting high severity with network attack vector, low attack complexity, and no user interaction required.

Exploitation of this vulnerability leads to a server crash (denial of service) in affected MongoDB Server versions. The attacker must be logged in but does not require special privileges. There is no evidence of data breach or privilege escalation. The impact is limited to service availability disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restrict access to authenticated users and monitor for attempts to use $changestreams with $_requestReshardingResumeToken and the exchange option. Avoid issuing such statements if possible.