CVE-2026-9746CWE-617

Server crashes in case of the use of exchange

High · published June 9, 2026

CVSS v4.0
7.1
EPSS
0%
Percentile
39.9
In the wild
Unconfirmed
What it is

When using $changestreams and $_requestReshardingResumeToken with the exchange option the server hits an invariant which causes the server to crash. There are no special privileges needed. The user must be logged in to issue the statement.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00472 · 39.9th percentile
Weakness
CWE-617 · Reachable Assertion
Published
2026-06-09T22:02Z
EPSS history
Timeline
  • 09 JUN 22:02Z
    Server crashes in case of the use of exchange
    cvelistv5