# CVE-2026-120815

Local privilege escalation in MongoDB Server allows host users to gain admin rights.

- Page: https://www.vulneraibility.com/cve/CVE-2026-120815
- CVSS: 8.6
- Known exploited: not in CISA KEV as of our last sync
- Weakness: CWE-863
- Published: 2026-11-10

## Affected versions

- MongoDB MongoDB Server: affected >= 9.0.0 and < 9.0.7; >= 8.3.0 and < 8.3.16; >= 8.0.0 and < 8.0.37; >= 7.0.0 and < 7.0.48

A version outside these ranges is not a statement that it is unaffected.

## Impact

Local unauthenticated user with localhost access can obtain admin privileges, read/modify/delete data, exfiltrate credentials, and disrupt DB availability.

## Action

Immediate action required

## Recommendation

Apply vendor fixes when available; restrict localhost access, rotate credentials, enable monitoring.

## References

- [other] https://jira.mongodb.org/browse/SERVER-134872

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.