HKCERT published a security bulletin on 14 October 2026 about multiple flaws in MongoDB Server. It said a remote attacker could use some of them to cause denial of service, sensitive information disclosure and security restriction bypass. The bulletin's version lists do not match. One names 8.0 before 8.0.34, 8.3.0 before 8.3.13, and two 9.0 entries, before 9.0.2 and before 9.0.4. A second list also names 7.0 before 7.0.45.
The bulletin does not name the flaws, give identifiers or rate their severity. It does not say whether attacks are under way, or which flaw causes which effect. The 9.0 entries appear twice with garbled text, and no reason is given. HKCERT points readers to MongoDB's security alerts page, which is the place to confirm affected versions.
In general terms, denial of service means a database stops answering. Information disclosure means data reaches people who should not see it. A security bypass means a protection gets skipped. A remote attacker needs network access, so exposed or poorly separated databases carry more risk. Teams can ask which versions they run, who can reach them, and who owns patching.