MongoDB lists pre-auth use-after-free CVE-2026-118383 at 9.5, fixed in seven release lines
MongoDB's CVE record for CVE-2026-118383, published on 10 November 2026, describes a use-after-free on replica set members that requests without authentication can cause. It scores 9.5, is fixed in seven release lines from 4.4 to 9.0, and prints no workaround, no credit and no exploitation status.
By Parminder Kumar Sharma · LinkedIn · · 17 min read
26 CVEs in 21 minutes, one at 9.5, and seven release lines
MongoDB's security bulletins page lists 26 CVEs dated 10 November 2026. The page's own data stamps them between 20:02:53 and 20:24:31 UTC, a span of 21 minutes 38 seconds (derived). The highest score in the batch is 9.5, for CVE-2026-118383, titled "Pre-authentication use-after-free in MongoDB Server replica set primary catch-up". Its affected ranges run through seven release lines, 4.4 to 9.0, each fixed in its own patch release: 9.0.7, 8.3.16, 8.0.37, 7.0.48, 6.0.30, 5.0.35 and 4.4.32. Only one other entry in the 26, CVE-2026-120828 at 8.7, reaches all seven lines; none of the other 24 reaches more than four (derived).
Counted as version numbers, the seven affected ranges hold 205 patch numbers (derived: 7 + 16 + 37 + 48 + 30 + 35 + 32). That is an upper bound, not a count of builds: the release notes for the four newest lines list 83 dated patch releases below the fixed ones (derived: 4 + 10 + 30 + 39), and the notes for the three oldest lines were not on the pages read.
What this does not establish: that anyone has exploited the flaw, that a public exploit or proof of concept exists, who found it, whether a default or typical deployment can be reached by an unauthenticated party, whether MongoDB Atlas is patched, or any workaround. None of the pages read states any of these. As read between 15:00 and 15:07 UTC on 12 November 2026, NVD shows the record with status "Awaiting Analysis", and the CISA Known Exploited Vulnerabilities feed copy dated 2026-11-10T19:03:29Z, which was released before the CVE record was published, lists none of the 26 IDs.
What the bulletin, the CVE record and NVD print about CVE-2026-118383
The bulletin card shows the date 11/10/2026 (read month first, which the page's own data confirms as 2026-11-10), the score 9.5, the title, a truncated opening of the description that ends in "View more", the seven version ranges, and one reference link, to the Jira ticket SERVER-138119. The full text is in the CVE record, which MongoDB published as its own CNA on 2026-11-10 at 20:23:51 UTC, having reserved the ID on 2026-10-28 at 02:46:37 UTC (13 days 17 hours earlier, derived).
Impact, in MongoDB's words. The use-after-free occurs "when a newly elected replica set primary completes catch-up". MongoDB says it "may result in the server terminating unexpectedly or, under certain conditions, arbitrary code execution in the context of the server process". Two outcomes are named, a crash and, under unspecified conditions, code execution in the server process. The record does not say which conditions, and does not say that code execution has been demonstrated.
The precondition. The same text says "The condition can be caused by requests that do not require authentication". That is the only text in the record behind the word pre-authentication in the title. The record does not say which requests, from what network position, or whether the party sending them can make the election happen or only has to be connected when one does.
Exposure. "Replica set members are affected, including the shard and config server replica set members of sharded clusters; standalone mongod instances are not." The record does not mention mongos routers, does not say whether any default configuration is exposed, and says nothing about Atlas.
How CVE-2026-118383 is scored, from the CVE record and NVD, read 12 November 2026. The reading of the vector letters is this site's, using the CVSS definitions.
| Item | As printed | Who assigned it |
|---|---|---|
| CVSS 4.0 base score | 9.5, CRITICAL. Network, attack complexity high, no attack requirements, no privileges, no user interaction, high impact on confidentiality, integrity and availability, and high impact on subsequent systems | MongoDB, as CNA. NVD lists it as a secondary source |
| CVSS 3.1 base score | 9.0, CRITICAL. Same vector except scope changed | MongoDB, as CNA. NVD lists it as a secondary source |
| Weakness | CWE-416, Use After Free | MongoDB, as CNA |
| Discovery | INTERNAL (the record's source field) | MongoDB, as CNA |
| NVD's own analysis | None yet: status Awaiting Analysis, no NVD score | NVD |
Two points on the score. First, the bulletin prints 9.5 without saying which CVSS version it is; the record says it is the 4.0 score, and the 3.1 score is 9.0. Second, the vector rates attack complexity high, and the record does not say what makes it high. This site's inference, not MongoDB's statement: a flaw that fires when a newly elected primary completes catch-up depends on an election, and the pages do not say whether an outside party can bring one about. The vector also rates impact on subsequent systems as high (scope changed in 3.1), while the description speaks only of the server process; the record does not say which other system is meant.
Which ticket is the fix: the bulletin links one, the record lists two
The bulletin's reference for CVE-2026-118383 is SERVER-138119. Its Jira page, as read, is titled "Allow only system users to use readConcern afterOpTime", has the type New Feature and the priority Major - P3, and was resolved on 2026-11-10 at 19:19:46 UTC. That ticket is also the only reference in the CVE record for CVE-2026-120828, which the bulletin scores 8.7 and which MongoDB describes as memory exhaustion from a read option that names a point in time the node will never reach: "A party with network access and no credentials can cause these records to accumulate without bound". So the bulletin's link for the 9.5 entry points at a ticket that matches the other entry's description better.
The CVE record for CVE-2026-118383 itself lists two references: SERVER-138119 and SERVER-138175. The second is titled "Fix use-after-free in CatchupState::abort() reentrancy via _catchupState", has the type Bug and the priority Critical - P2, was created on 2026-10-29 at 15:29:27 UTC and resolved on 2026-11-10 at 19:18:43 UTC, which is 12 days 3 hours 49 minutes 16 seconds (derived). The first ticket was created on 2026-10-28 at 20:29:05 UTC, 12 days 22 hours 50 minutes 41 seconds before it was resolved (derived). Both pages list the same fix versions, 6.0.30, 5.0.35, 4.4.32, 8.3.16, 9.0.7, 8.0.37, 7.0.48 and two 9.1.0 release candidates, and the release notes for 9.0.7, 8.3.16, 8.0.37 and 7.0.48 each name both tickets.
What can and cannot be read there. The saved Jira pages show the fields above, the owning teams (Replication, and Replication - Oplog and Recovery) and the dates. They show no description and no comments, so they do not say what a request does to reach the bug, and the pages do not say whether the afterOpTime restriction is part of the fix for the unauthenticated path. This site does not infer that. The Jira pages name individuals as assignee and reporter; they are not named here.
The 10 November batch: two critical, 16 high, five medium, three low
The bulletin does not label severity bands. Applying the usual CVSS bands to the scores it prints gives (derived) 2 at 9.0 or above, 16 from 7.0 to 8.9, 5 from 4.0 to 6.9 and 3 below 4.0. The second critical is CVE-2026-120808 at 9.1, a certificate validation bypass in the macOS TLS client, which reaches four lines. Four entries are titled with an authentication state: CVE-2026-118383 says pre-authentication, and CVE-2026-120817, CVE-2026-120821 and CVE-2026-120824 say post-authentication. CVE-2026-120828's record describes a party with no credentials, but its impact is availability only.
Only the titles, scores and version ranges of the other 25 entries were used for this briefing; their full records were not read, so nothing is said here about their triggers. If your line appears in several entries, the release that fixes CVE-2026-118383 is also the release that carries the others: the release notes for each of the four newest lines list exactly the CVE IDs the bulletin gives for that line (25 for 9.0.7, 21 for 8.3.16, 19 for 8.0.37, 16 for 7.0.48, derived and matched). For 6.0, 5.0 and 4.4 the bulletin lists two entries each, CVE-2026-118383 and CVE-2026-120828.
Seven release lines, and what the pages say about the three oldest
Release lines affected by CVE-2026-118383, from the bulletin, the CVE record, the two Jira pages and the release notes, read 12 November 2026.
| Line | Fixed in, as listed | What was read |
|---|---|---|
| 9.0 | 9.0.7 | Release notes dated Nov 10, 2026 name the CVE. 9.0.8, also dated Nov 10, is for five platform variants that have no 9.0.7 binary |
| 8.3 | 8.3.16 | Release notes dated Nov 10, 2026. 8.3.17, also dated Nov 10, covers four variants without 8.3.16 binaries |
| 8.0 | 8.0.37 | Release notes dated Nov 10, 2026. 8.0.38, also dated Nov 10, covers two variants |
| 7.0 | 7.0.48 | Release notes dated Nov 10, 2026. No later patch listed on the page |
| 6.0 | 6.0.30 | Bulletin and both Jira pages only. No release notes page for this line on the documentation index |
| 5.0 | 5.0.35 | Bulletin and both Jira pages only. No release notes page for this line on the documentation index |
| 4.4 | 4.4.32 | Bulletin and both Jira pages only. No release notes page for this line on the documentation index |
Same day follow-ups. Three of the four newest lines have a second patch dated the same day. Their release notes list one ticket, SERVER-138547, "Use target architecture in cross-compiled archive directory names", and tell users of specific platform variants to take the later binary instead. So "fixed in 9.0.7" can mean a 9.0.8 binary on some platforms. MongoDB's versions page says: "You should always run the latest patch release for your major and minor version."
The three oldest lines. The documentation's release notes index lists 9.0 as the current stable release and 8.3, 8.0 and 7.0 as previous stable releases, then an "EOL Releases" heading that points to legacy documentation without naming versions. The addresses requested for the 6.0, 5.0 and 4.4 release notes returned that index page itself, byte for byte, so the notes for 6.0.30, 5.0.35 and 4.4.32 were not read. MongoDB's versions page says: "Each MongoDB major version is supported for five years, with an optional two-year Extended Lifecycle Support (ELS) period available to Enterprise Advanced customers." It also says: "When a version reaches end of life, it no longer receives fixes, including security fixes" None of the pages read says which of 6.0, 5.0 and 4.4 is inside the support period, under Extended Lifecycle Support, or past end of life. The bulletin and Jira do show that fixed builds exist for all three, dated by the bulletin to 10 November. MongoDB sells Atlas and Enterprise Advanced, and the extended period is an Enterprise Advanced offer, so the company has a commercial interest in how old lines are described.
Atlas. MongoDB's versions page says "MongoDB releases reach Atlas before they become available for self-managed deployments." It does not say that Atlas clusters have received the CVE-2026-118383 fix, and neither does the bulletin. Whether Atlas is patched is not established here.
A critical score and the word pre-authentication are not an exposure assessment
The title says pre-authentication and the badge says 9.5. Neither tells an operator whether a given cluster can be hit. The record's own text narrows the population: standalone servers are not affected, and the flaw sits on replica set members (including shard and config server members). Its own vector says attack complexity is high. And the trigger is a newly elected primary finishing catch-up, an event that happens at failover. A label that says the attacker needs no account is a statement about credentials, not about network reach. Whether the replica set port is open to the internet, to a flat internal network or only to the application tier decides the real risk, and no page read gives that for any deployment.
What MongoDB's pages state, and what they do not
CVE-2026-118383 as stated by MongoDB's bulletin, the CVE record, the two Jira pages and the release notes, read 12 November 2026 between 15:00 and 15:07 UTC.
| Question | Stated | Not stated |
|---|---|---|
| What can happen | The server terminating unexpectedly or, under certain conditions, arbitrary code execution in the server process | Which conditions; whether code execution has been shown |
| What triggers it | A newly elected replica set primary completing catch-up; requests that do not require authentication | Which requests; the network position needed; whether an outsider can cause the election |
| Who is affected | Replica set members, including shard and config server members. Standalone mongod instances are not | Mongos routers; any default configuration; any share of deployments |
| How bad | 9.5 (CVSS 4.0) and 9.0 (CVSS 3.1), both MongoDB's, attack complexity high | Which version the bulletin's 9.5 is; what makes complexity high; an NVD score |
| Fixed where | 9.0.7, 8.3.16, 8.0.37, 7.0.48, 6.0.30, 5.0.35, 4.4.32 | Release dates of the last three (their notes were not read); which lines are supported |
| Who found it | Source field says INTERNAL | A name, a team, a report date or any credit |
| Exploitation | Nothing; the exploit maturity field is not defined; the CISA feed copy lists none of the 26 IDs | Any exploitation, exploit code or scanning |
| Workaround | Nothing printed | Any mitigation short of upgrading |
| Atlas | Releases reach Atlas before self-managed deployments, as a general statement | Whether Atlas clusters have the fix |
Where the sources differ
The reference ticket. The bulletin links SERVER-138119 for CVE-2026-118383, a feature ticket that is also the sole reference of CVE-2026-120828. The CVE record lists SERVER-138119 and SERVER-138175, and only the second is titled as a use-after-free fix. Both are in the release notes. The article keeps the difference: the pages do not say why the bulletin shows one link.
One score or two. The bulletin prints 9.5 only. The record has 9.5 (CVSS 4.0) and 9.0 (CVSS 3.1). NVD repeats both as secondary data from MongoDB.
Backports. Both Jira pages have a field "Backport Requested" listing four lines, 9.0, 8.3, 8.0 and 7.0, while their fix versions and the bulletin list seven lines. The pages do not explain the gap.
Dates. The ID was reserved on 2026-10-28 at 02:46:37 UTC, before the creation times printed on the two Jira pages (2026-10-28 at 20:29:05 UTC and 2026-10-29 at 15:29:27 UTC). The pages do not say why. NVD's published time, 2026-11-10T21:18:58.980, carries no time zone in the response. On the day itself all sources agree: 10 November 2026.
What to do, in order
MongoDB's position, as the pages print it, is the fixed release per line. Everything after the first item is this site's suggestion, built from what the pages leave unsaid; none of it comes from MongoDB.
Take this with you
Order of work
- MongoDB's position: upgrade to the fixed release for your line (9.0.7, 8.3.16, 8.0.37, 7.0.48, 6.0.30, 5.0.35 or 4.4.32), and run the latest patch release of the line. Take the same day follow ups where your platform needs them: 9.0.8, 8.3.17 or 8.0.38.
- This site's suggestion: list every MongoDB server by deployment type (self-managed, embedded in an appliance or container image, managed by an operator, Atlas), version and role. Ask each running node for its version rather than trusting the asset record; the shell's db.version() helper does that.
- Separate replica set members, including shard and config server members, from standalone servers. The record says standalone instances are not affected.
- Rank the affected members by who can open a connection to them. Anything reachable beyond the application tier, from another network zone, a partner link or the internet, goes first. The pages do not say what network position is needed, so treat any reachable member as in scope.
- Upgrade in your line following MongoDB's upgrade documentation for it (not read for this briefing), and log the version after each node restarts.
- For 6.0, 5.0 and 4.4: ask MongoDB, or check your contract, whether the line is supported or covered by extended support. The bulletin lists fixed builds, but no page read says the lines are supported. If they are not, plan a move to a supported line.
- For Atlas: check the server version each cluster reports against the fixed release for its line. MongoDB's pages read do not say Atlas is patched.
- Alert on unexpected restarts of replica set members, especially around elections. A crash is the stated minimum impact. This is a detection idea of this site's, not a rule MongoDB prints.
- Then review the other entries in the batch that reach your line, starting with the sharded view and aggregation authorization entries (CVE-2026-120825 and CVE-2026-120826 name 9.0 only) and your use of read concern options.
Technical details
MongoDB's pages print identifiers, scores, version ranges and ticket titles. They print no indicator of compromise, no detection rule, no query, no configuration setting to change and no workaround, and no exploit detail beyond the description. The blocks below are what the pages do print, copied as written; only the layout is this site's.
The bulletin entry. This is the card for CVE-2026-118383 on the bulletins page, laid out as lines. The description is cut off on the page itself at "newly ele..."; the full text is in the CVE record. A defender uses the version ranges to tag each server in an inventory and the reference to find the ticket.
11/10/2026
CVE-2026-118383
9.5
Pre-authentication use-after-free in MongoDB Server replica set primary catch-up
A use-after-free in the replication component of MongoDB Server can occur when a newly ele...
Affects: MongoDB Server
9.0.0 affects versions prior to 9.0.7
8.3.0 affects versions prior to 8.3.16
8.0.0 affects versions prior to 8.0.37
7.0.0 affects versions prior to 7.0.48
6.0.0 affects versions prior to 6.0.30
5.0.0 affects versions prior to 5.0.35
4.4.0 affects versions prior to 4.4.32
Reference Link: https://jira.mongodb.org/browse/SERVER-138119
The CVE record. These are selected fields of the CVE Program record published by MongoDB as CNA, one per line, with the values as stored. The description is the full text. A defender uses the version ranges and the CWE to tag the finding in a tracker, and the two vectors to see how MongoDB scored it. The vectors are strings of letter pairs; they are explained in the table above.
cveMetadata.cveId: CVE-2026-118383
cveMetadata.assignerShortName: mongodb
cveMetadata.state: PUBLISHED
cveMetadata.dateReserved: 2026-10-28T02:46:37.683Z
cveMetadata.datePublished: 2026-11-10T20:23:51.424Z
cna.title: Pre-authentication use-after-free in MongoDB Server replica set primary catch-up
cna.problemTypes: CWE-416: Use After Free
cna.descriptions: A use-after-free in the replication component of MongoDB Server can occur when a newly elected replica set primary completes catch-up. The condition can be caused by requests that do not require authentication, and may result in the server terminating unexpectedly or, under certain conditions, arbitrary code execution in the context of the server process. Replica set members are affected, including the shard and config server replica set members of sharded clusters; standalone mongod instances are not.
cna.source.discovery: INTERNAL
cna.references: https://jira.mongodb.org/browse/SERVER-138119 ; https://jira.mongodb.org/browse/SERVER-138175
cna.metrics cvssV4_0: baseScore 9.5, baseSeverity CRITICAL
vectorString: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
cna.metrics cvssV3_1: baseScore 9, baseSeverity CRITICAL
vectorString : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
cna.affected[0].defaultStatus: unaffected
cna.affected[0].versions: 9.0.0 lessThan 9.0.7 (semver, affected)
cna.affected[0].versions: 8.3.0 lessThan 8.3.16 (semver, affected)
cna.affected[0].versions: 8.0.0 lessThan 8.0.37 (semver, affected)
cna.affected[0].versions: 7.0.0 lessThan 7.0.48 (semver, affected)
cna.affected[0].versions: 6.0.0 lessThan 6.0.30 (semver, affected)
cna.affected[0].versions: 5.0.0 lessThan 5.0.35 (semver, affected)
cna.affected[0].versions: 4.4.0 lessThan 4.4.32 (semver, affected)
The release notes. The 9.0.7 and 8.0.37 notes list both tickets among the fixes. The 9.0.8 line and the 8.3.16 note matter for patching: some platform variants have no binary for the first patch of a line. A defender checks the platform list in the release notes for their line before choosing the target version.
9.0.7 - Nov 10, 2026 (release notes for MongoDB 9.0)
SERVER-138119 : Allow only system users to use readConcern afterOpTime
SERVER-138175 : Fix use-after-free in CatchupState::abort() reentrancy via _catchupState
8.0.37 - Nov 10, 2026 (release notes for MongoDB 8.0, same two entries, printed without the colon)
SERVER-138119 Allow only system users to use readConcern afterOpTime
SERVER-138175 Fix use-after-free in CatchupState::abort() reentrancy via _catchupState
9.0.8 - Nov 10, 2026
SERVER-138547 Use target architecture in cross-compiled archive directory names
Note, release notes for 8.3.16: If you run MongoDB on one of these variants, use the corresponding MongoDB 8.3.17 binaries instead
The Jira pages. These are the details fields the two ticket pages show without a login. The fix versions are the quickest way to confirm that a line has a fix; the two release candidates of 9.1.0 are listed but the 9.1 line is not in the bulletin's affected ranges. The assignee and reporter fields name individuals and are left out.
SERVER-138119 Allow only system users to use readConcern afterOpTime
Type: New Feature
Resolution: Fixed
Priority: Major - P3
Fix Version/s: 6.0.30 , 5.0.35 , 4.4.32 , 9.1.0-rc0 , 8.3.16 , 9.0.7 , 8.0.37 , 7.0.48 , 9.1.0-rc1026
Affects Version/s: None
Assigned Teams: Replication , Replication - Oplog and Recovery
Backport Requested: v9.0 , v8.3 , v8.0 , v7.0
Created: Oct 28 2026 08:29:05 PM UTC
Resolved: Nov 10 2026 07:19:46 PM UTC
SERVER-138175 Fix use-after-free in CatchupState::abort() reentrancy via _catchupState
Type: Bug
Resolution: Fixed
Priority: Critical - P2
Fix Version/s: 6.0.30 , 5.0.35 , 4.4.32 , 9.1.0-rc0 , 8.3.16 , 9.0.7 , 8.0.37 , 7.0.48 , 9.1.0-rc1026
Affects Version/s: None
Assigned Teams: Replication , Replication - Oplog and Recovery
Backport Requested: v9.0 , v8.3 , v8.0 , v7.0
Created: Oct 29 2026 03:29:27 PM UTC
Resolved: Nov 10 2026 07:18:43 PM UTC
NVD and the CISA catalogue. NVD had the record in its queue, not analysed, and carried only MongoDB's own scores. If a scanner or ticket system shows no NVD score for this CVE today, this is why. The CISA feed copy was released before the CVE record was published, so its silence says little; the last line of the block is this site's own search of that copy.
NVD CVE API, id CVE-2026-118383
vulnStatus: Awaiting Analysis
published: 2026-11-10T21:18:58.980
lastModified: 2026-11-10T22:08:59.707
sourceIdentifier: cna@mongodb.com
cvssMetricV40: source cna@mongodb.com, type Secondary, baseScore 9.5, baseSeverity CRITICAL
cvssMetricV31: source cna@mongodb.com, type Secondary, baseScore 9.0, baseSeverity CRITICAL
weaknesses: CWE-416, source cna@mongodb.com, type Secondary
CISA Known Exploited Vulnerabilities feed
catalogVersion: 2026.11.10
dateReleased: 2026-11-10T19:03:29.8375Z
count: 1779
entries matching any of the 26 CVE IDs dated 10 November by MongoDB: 0 (this site's search)
The question the pages leave open
MongoDB has said which releases fix CVE-2026-118383 and that standalone servers are not affected. It has not said what an unauthenticated request must look like, from where it must come, or whether anyone has tried it. Which of your replica set members, and which shard and config server members, accept connections from anywhere other than your application tier today, and which line are they running?
Key facts
Sources
- PrimaryMongoDB security bulletins (Alerts) page: the 26 CVE entries dated 10 November 2026, with scores, titles, version ranges and reference links. Saved by the lead about 15:00 UTC on 12 November 2026MongoDBaccessed 2026-11-12
- PrimaryCVE record for CVE-2026-118383, published by MongoDB as CNA: description, CWE, version ranges, both CVSS vectors, referencesCVE Program (CVE.org)accessed 2026-11-12
- PrimaryCVE record for CVE-2026-120828: description and sole reference, used to compare with the bulletin's link for CVE-2026-118383CVE Program (CVE.org)accessed 2026-11-12
- PrimarySERVER-138119, Allow only system users to use readConcern afterOpTime: type, priority, fix versions, datesMongoDB Jira (SERVER project)accessed 2026-11-12
- PrimarySERVER-138175, Fix use-after-free in CatchupState::abort() reentrancy via _catchupState: type, priority, fix versions, datesMongoDB Jira (SERVER project)accessed 2026-11-12
- PrimaryRelease notes for MongoDB 9.0: 9.0.7 and 9.0.8, both dated Nov 10, 2026MongoDB documentationaccessed 2026-11-12
- PrimaryRelease notes for MongoDB 8.3: 8.3.16 and 8.3.17, both dated Nov 10, 2026MongoDB documentationaccessed 2026-11-12
- PrimaryRelease notes for MongoDB 8.0: 8.0.37 and 8.0.38, both dated Nov 10, 2026MongoDB documentationaccessed 2026-11-12
- PrimaryRelease notes for MongoDB 7.0: 7.0.48, dated Nov 10, 2026MongoDB documentationaccessed 2026-11-12
- PrimaryRelease notes index: lists 9.0, 8.3, 8.0 and 7.0 and an EOL Releases heading; the pages for 6.0, 5.0 and 4.4 resolve to itMongoDB documentationaccessed 2026-11-12
- PrimaryMongoDB Versions and Upgrade Paths: support lifecycle, patch release advice, how releases reach AtlasMongoDB documentationaccessed 2026-11-12
- PrimaryNVD record for CVE-2026-118383 at 15:04 UTC on 12 November 2026: status Awaiting Analysis, MongoDB's scores as secondary dataNIST National Vulnerability Databaseaccessed 2026-11-12
- PrimaryKnown Exploited Vulnerabilities catalogue version 2026.11.10 (released 19:03 UTC): checked that none of the 26 IDs is listedCISAaccessed 2026-11-12
