CVE-2026-18699

The gap between this CVE's CVSS 6.5 rating and its 0.28% EPSS probability deserves scrutiny, but not for the reason you might expect. The real issue isn't that EPSS underweights this bug — it's that EPSS measures exploitation likelihood while CVSS measures severity, and these are genuinely orthogonal signals. The question is whether your organization is using them correctly in tandem. Start with the access requirement. CVSS flags this as exploitable by an 'authenticated user with read-level privileges,' which sounds restrictive. In practice, MongoDB read access is commonly provisioned far beyond the users who would trigger other server-side vulnerabilities — application service accounts, ETL pipelines, analytics tools, and reporting systems routinely hold broad read access across collections. If your read-access population includes any accounts beyond strict human users, the 'authenticated user' gate is weaker than CVSS assumes. Two factors do explain the low EPSS, though. First, text indexes are vestigial infrastructure in MongoDB — Atlas Search has been the recommended path since 2021, meaning the code path affected receives less active engineering attention and fewer engineers write queries against text indexes in normal development. The attack surface is narrowing, not growing. Second, the specific trigger requires a collection with text indexing active, which is far rarer than general collection access. The doubly-constrained condition — read access plus text index presence — is why this clusters in fuzzing reports rather than active exploitation. Here's what EPSS doesn't model: the blast radius. A query planner crash doesn't just affect the attacker — it terminates the server process, affecting every connected client and every in-flight operation simultaneously. This is a failure cascade, not a targeted denial-of-service. The expected damage per exploitation event is catastrophically higher than 'Medium' implies, regardless of how unlikely exploitation is. For prioritization: if you're on fully managed MongoDB Atlas, this is likely already patched or queued for automatic upgrade — the EPSS/CVSS calculus only matters for self-managed deployments. The narrow trigger conditions and vestigial code path argue against accelerating patch timelines beyond your standard remediation SLA. But track it explicitly rather than relying on EPSS to deprioritize it, because when this one does trigger — accidentally through a misconfigured analytics job or deliberately by a low-privilege insider — the impact is the entire workload on that instance, not a single session.

Reviewed through automated stages and approved by a human before publication.