An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command missing required fields. The flaw is a CWE-617: Improper Validation of Input, originating from inconsistent validation among transaction command parameters, leading to a fatal internal invariant failure and a denial of service. The impact results in a crash of the database daemon, interrupting service availability and potentially aborting ongoing operations, which constitutes significant disruption in production environments that rely on continuous database operations.

This vulnerability affects MongoDB Server, as documented by the CNA. The advisory does not list specific version numbers, so all releases up to the one that includes the referenced Jira issue are potentially impacted. Systems that allow clients with write privileges to construct transaction commands are at risk. Administrators should verify if their deployments enable transaction commands and confirm whether a patch is available for their version.

The CVSS score of 7.1 indicates high severity, while the EPSS score of < 1% shows a very low probability of exploitation at the time of analysis. The flaw is not in the CISA KEV catalog. Exploitation requires authentication and basic write access, so internal users or compromised accounts can trigger a denial of service. Because the issue does not enable code execution, the risk is limited to availability loss, but in critical contexts this can lead to significant operational impact.