# Security Advisory: Percona Server for MongoDB 🚨

**URL:** <https://forums.percona.com/t/security-advisory-percona-server-for-mongodb/40798>\
**Category:** Percona Server for MongoDB\
**Created:** [May 14, 2026, 8:46am UTC](https://forums.percona.com/t/security-advisory-percona-server-for-mongodb/40798 "2026-05-14T08:46:54Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![radoslaw.szulgo](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/radoslaw.szulgo/32/17315_2.png) [@radoslaw.szulgo](https://forums.percona.com/u/radoslaw.szulgo)\
**Post date:** [May 14, 2026, 8:46am UTC](https://forums.percona.com/t/security-advisory-percona-server-for-mongodb/40798/1 "2026-05-14T08:46:54Z")

</div>

**Date:** May 12-13, 2026

**Primary Affected Versions:**

- Percona Server for MongoDB 7.0.x (pre-7.0.34) and Community

- Percona Server for MongoDB 8.0.x (pre-8.0.23) and Community,

🔴 **High Priority**

- **CVE-2026-8053 (FlatBSON Index Drift)**

- **CVE-2026-8336 (UAF in $\_internalJsEmit)**

- **CVE-2026-8199 (Memory Exhaustion)**

🟡 **Medium Priority**

- **CVE-2026-8201 (FLE Use-After-Free)**

- **CVE-2026-8202 (CPU Utilization DoS)**

- **CVE-2026-8200 (Schema Validation Leak)**

**Next steps:** Releases are in preparation now. ETA end of next week (tentative / not committed yet). I’ll confirm as soon as possible.

---

<div class="post-metadata">

**Author:** ![Ahmet\_Soguksu1](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/ahmet_soguksu1/32/23331_2.png) [@Ahmet\_Soguksu1](https://forums.percona.com/u/Ahmet_Soguksu1)\
**Post date:** [May 20, 2026, 5:16pm UTC](https://forums.percona.com/t/security-advisory-percona-server-for-mongodb/40798/2 "2026-05-20T17:16:34Z")

</div>

Hi,

Following the security advisory from May 12-13 regarding Percona Server for MongoDB (CVE-2026-8053, CVE-2026-8336, CVE-2026-8199, and others), I wanted to check if there’s any update on the patched release timeline.

The original post indicated an ETA of end of last week, but I haven’t seen a follow-up announcement yet. Could you confirm the current status?

We’re running affected versions in production and need to plan our maintenance window accordingly.

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![radoslaw.szulgo](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/radoslaw.szulgo/32/17315_2.png) [@radoslaw.szulgo](https://forums.percona.com/u/radoslaw.szulgo)\
**Post date:** [May 20, 2026, 5:54pm UTC](https://forums.percona.com/t/security-advisory-percona-server-for-mongodb/40798/3 "2026-05-20T17:54:52Z")

</div>

Sure. Here’s a blog post from me with all the details: [https://www.percona.com/blog/cve-2026-8053-we-dont-use-time-series-is-not-a-mitigation/](https://www.percona.com/blog/cve-2026-8053-we-dont-use-time-series-is-not-a-mitigation/)