CVE-2026-84962EPSS p7.3%

CVE-2026-84962CVE-2026-84962

mongodb / libmongocrypt

Description

An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption.

Scoring

CVSS 4.2 ()
VectorCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N
EPSS0.18% probability of exploitation · percentile 7.3% · 2026-10-05T12:00:23Z
Last modified2026-09-17
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.