CVE Watchtower


← Back to CVE List

CVE-2026-9741NVD

Vulnerability Summary

A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE) results in literal values for encrypted fields within the $vectorSearch stage filter expressions to be sent to the server as plaintext instead of ciphertext.
Severity Level
MEDIUM(6.5)
Published Date
Jun 9, 2026
Last Modified
Jun 10, 2026
Exploitation Status
????
EPSS Score (30-Day)
0.01%Probability
Root Weakness (CWE)
N/A
CVSS v3.1 Base Metrics
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityNone
AvailabilityNone