This vulnerability (CVE-2026-9746) in MongoDB Server involves a reachable assertion failure triggered when a logged-in user issues a statement using $changestreams and $_requestReshardingResumeToken with the exchange option. The assertion causes the server to crash, impacting availability. No special privileges are required beyond being logged in. The CVSS 4.0 base score is 7.1, indicating high severity. Affected versions explicitly include 7.0.0, 8.0.0, 8.2.0, and 8.3.0. There is no vendor advisory or patch information available, and the remediation level is not specified.

Successful exploitation causes the MongoDB server to crash due to an assertion failure, resulting in a denial of service. The vulnerability requires only that the attacker be logged in, with no special privileges needed. There is no indication of data compromise or privilege escalation from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to authenticated users and monitor for attempts to use $changestreams with $_requestReshardingResumeToken and the exchange option. Avoid issuing such statements if possible.