percona · rasika-chivate · Aug 5, 2026 · Jul 31, 2026 · Jul 31, 2026 · Jul 31, 2026
diff --git a/docs/_templates/pdf_cover_page.tpl b/docs/_templates/pdf_cover_page.tpl
@@ -3,10 +3,10 @@
 <p>
 <img src="_images/Percona_Color_Dark.svg" alt="Percona logo" />
 </p>
-<h1>Server for MongoDB 7.0.37-20</h1>
+<h1>Server for MongoDB 7.0.39-21</h1>
 {% if config.site_description %}
 <h1>{{ config.site_description }}</h1>
 {% endif %} 
-<h2>7.0.37-20 (June 23, 2026)</h2>
+<h2>7.0.39-21 (August 05, 2026)</h2>
 <br>
 <br>
diff --git a/docs/release_notes/7.0.39-21.md b/docs/release_notes/7.0.39-21.md
@@ -0,0 +1,97 @@
+---
+version: 7.0.39-21
+---
+
+# Percona Server for MongoDB {{ page.meta.version }} ({{date.7_0_39}})
+
+[Installation](../install/index.md){.md-button}
+[Upgrade from MongoDB Community](../install/upgrade-from-mongodb.md){.md-button}
+
+Percona Server for MongoDB {{ page.meta.version }} is an enhanced, source-available, and highly-scalable database that is a fully-compatible, drop-in replacement for MongoDB Community Edition.
+
+Percona Server for MongoDB **{{ page.meta.version }}** includes the improvements and bug fixes of:
+
+- [MongoDB 7.0.39 Community Edition :octicons-link-external-16:](https://www.mongodb.com/docs/manual/release-notes/7.0/#7.0.39---july-22--2026){:target="_blank"}.
+
+- Supports protocols and drivers of MongoDB Community **7.0.39**.
+
+## Upgrade recommendation
+
+This release contains multiple high-severity security fixes affecting all Percona Server for MongoDB 7.0.x versions. We strongly recommend **upgrading to version {{ page.meta.version }}** as soon as possible.
+
+## Release Highlights
+
+### Software Bill of Materials (SBOM)
+
+Percona Server for MongoDB (PSMDB) now provides Software Bills of Materials (SBOMs) and Vulnerability Exploitability Exchange (VEX) for every release. SBOMs improve software supply chain transparency by documenting the components and dependencies included in a build. They are generated automatically as part of the release pipeline in the industry standard [CycloneDX :octicons-link-external-16:](https://cyclonedx.org/specification/overview/){:target="_blank"} format.
+
+SBOMs are distributed through the following channels:
+
+- Tarballs: An SBOM is included in `doc/sbom.cdx.json` file.
+
+- Packages: For `.deb` and `.rpm` packages, the SBOM file is installed in a standard documentation directory such as `/usr/share/doc/percona-server-mongodb-server/sbom.cdx.json`.
+
+- Docker: The SBOM is attached directly to the Docker image as metadata.
+
+OpenVEX files are published on GitHub Pages and provide the exploitability status of known vulnerabilities.
+
+- Each release has a separate file that follows this format:
+
+```
+https://percona.github.io/percona-server-mongodb/vex/percona-server-mongodb-{{ release }}.vex.json
+```
+
+For comprehensive information, refer to our [documentation](../sbom.md).
+
+## Security fixes from upstream MongoDB
+
+### Critical severity
+
+- [SERVER-128494 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-128494){:target="_blank"} ([CVE-2026-13072 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-13072){:target="_blank"}): Fixed an issue where compute mode on a standalone MongoDB instance could cause memory corruption while processing externally sourced `BSON` data in an aggregation pipeline. This could cause the process to terminate or behave unexpectedly. Compute mode is disabled by default and must be enabled explicitly at startup.
+
+### High severity
+
+- [SERVER-123081 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-123081){:target="_blank"} ([CVE-2026-13055 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-13055){:target="_blank"}): Fixed an issue in the `$_internalIndexKey` aggregation expression. An authenticated user with permission to run aggregation pipelines could submit a compound wildcard index specification that caused mongod to stop, resulting in a denial-of-service attack.
+
+- [SERVER-127280 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-127280){:target="_blank"} ([CVE-2026-13065 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-13065){:target="_blank"}): Fixed an input validation issue in `$linearFill`. A user with read-only access could provide an unsupported expression in sortBy, causing `mongod` to stop and resulting in a denial-of-service.
+
+- [SERVER-127357 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-127357){:target="_blank"} ([CVE-2026-13060 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-13060){:target="_blank"}): Fixed an issue in the `$graphLookup` aggregation stage that could allow an authenticated user with limited read permissions to access documents from restricted collections. This could occur when the collections were referenced in an existing view pipeline.
+
+- [SERVER-127566 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-127566){:target="_blank"} ([CVE-2026-13069 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-13069){:target="_blank"}): Added a limit for the contention value used with **Queryable Encryption (FLE2)**. Previously, an authenticated user could submit a request with a very high value, consuming excessive CPU or memory and making the server slow or unresponsive.
+
+- [SERVER-127694 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-127694){:target="_blank"} ([CVE-2026-13066 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-13066){:target="_blank"}): Resolved an issue where improper handling of DBPointer objects during `BSON` serialization in the server-side JavaScript engine could expose internal memory contents to the client. This information disclosure vulnerability affected deployments that use server-side JavaScript.
+
+- [SERVER-127831 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-127831){:target="_blank"} ([CVE-2026-13062 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-13062){:target="_blank"}): Resolved an issue where an authenticated user with write privileges on a collection that supports Queryable Encryption could modify internal encryption metadata fields, which are intended to be controlled by the server. This was achieved by sending crafted write commands through the `mongos` router in a sharded cluster. As a result, this could lead to incorrectly encrypted queries.
+
+- [SERVER-128341](https://jira.mongodb.org/browse/SERVER-128341){:target="_blank"} ([CVE-2026-9737 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-9737){:target="_blank"}): Corrected an issue in query planning where reading the sort pattern in raw `BSONObj` form did not explicitly handle the meta-expression case. This omission could lead to incorrect transformations and potentially cause invariant failures.
+
+- [SERVER-128433 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-128433){:target="_blank"} ([CVE-2026-13059 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-13059){:target="_blank"}): Resolved an issue where an authenticated user with limited privileges could bypass role-based query-level access controls by submitting specially crafted command parameters. This could allow unauthorized read or write operations through the `find`, `update`, `delete`, and `aggregate` commands when strict API rules were not enforced.
+
+- [SERVER-128473 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-128473){:target="_blank"} ([CVE-2026-13071 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-13071){:target="_blank"}): Resolved an issue where an authenticated user with read access could terminate the `mongod` process using certain aggregation expressions that execute server-side JavaScript. This issue was caused by improper memory handling during document processing.
+
+- [SERVER-129103](https://jira.mongodb.org/browse/SERVER-129103){:target="_blank"} ([CVE-2026-13077 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-13077){:target="_blank"}): Fixed an issue where MongoDB did not properly validate `CodeWScope` elements in malformed `BSONColumn` data. An authenticated user could exploit this with a crafted aggregation pipeline, causing mongod to stop or expose nearby process memory.
+
+### Medium severity
+
+- [SERVER-127689 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-127689){:target="_blank"} ([CVE-2026-13061 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-13061){:target="_blank"}): Fixed an issue in the `$listSessions` aggregation stage that could expose session information to users without the required cluster-level privileges. An authenticated user could view other users’ `session IDs`, `usernames`, and `activity timestamps`.
+
+- [SERVER-128362 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-128362){:target="_blank"} ([CVE-2026-13070 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-13070){:target="_blank"}): Resolved an issue where a MongoDB server could terminate unexpectedly while processing a malformed OCSP response during an outbound TLS handshake. OCSP stapling validation is enabled by default for outgoing TLS connections. Exploitation required either a remote peer with a certificate issued by the cluster’s trusted certificate authority or a connection passing through an untrusted network path.
+
+- [SERVER-128517 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-128517){:target="_blank"} ([CVE-2026-13074 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-13074){:target="_blank"}): Fixed an issue where pre-authentication hello requests in exhaust mode accepted very small `maxAwaitTimeMS` values. An unauthenticated client could use this behavior to create a tight response loop that consumed excessive CPU and reduced server availability.
+
+- [SERVER-128832 :octicons-link-external-16:](https://jira.mongodb.org/browse/SERVER-128832){:target="_blank"} ([CVE-2026-13078 :octicons-link-external-16:](https://www.cve.org/CVERecord?id=CVE-2026-13078){:target="_blank"}): Fixed an issue discovered in MongoDB Server, where the server-side `MozJS` scripting engine unconditionally registered a module-loading hook that enables JavaScript to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit this through crafted aggregation pipeline commands to read sensitive files accessible to the MongoDB server process.
+
+For the complete upstream changelog, see [MongoDB 7.0.39 Community Edition :octicons-link-external-16:](https://www.mongodb.com/docs/manual/release-notes/7.0-changelog/#std-label-7.0.39-changelog){:target="_blank"}.
+
+## Changelog
+
+### New features
+
+* [PSMDB-2150](https://perconadev.atlassian.net/browse/PSMDB-2150): Percona Server for MongoDB (PSMDB) now provides Software Bills of Materials (SBOMs) for every release.
+
+## Tools packaged with this release
+
+| **Tool** | **Base version** | **Release notes** |
+|---|---|---|
+| MongoDB Shell (`mongosh`) | 2.9.2 | [upstream release notes :octicons-link-external-16:](https://www.mongodb.com/docs/mongodb-shell/changelog/#v2.9.2){:target="_blank"} |
+| Mongo Tools | 100.17.0 | [upstream release notes :octicons-link-external-16:](https://www.mongodb.com/docs/database-tools/release-notes/dbtools-100.17.0-changelog/){:target="_blank"} |
diff --git a/docs/release_notes/index.md b/docs/release_notes/index.md
@@ -1,6 +1,8 @@
 
 # Percona Server for MongoDB 7.0 release notes
 
+* [Percona Server for MongoDB 7.0.39-21 ({{date.7_0_39}})](7.0.39-21.md)
+
 * [Percona Server for MongoDB 7.0.37-20 ({{date.7_0_37}})](7.0.37-20.md)
 
 * [Percona Server for MongoDB 7.0.34-19 ({{date.7_0_34}})](7.0.34-19.md)

diff --git a/mkdocs-base.yml b/mkdocs-base.yml
@@ -240,6 +240,7 @@ nav:
       - install/uninstall.md
   - Release notes:
       - "Release notes index": "release_notes/index.md"
+      - release_notes/7.0.39-21.md
       - release_notes/7.0.37-20.md
       - release_notes/7.0.34-19.md
       - release_notes/7.0.32-18.md

diff --git a/variables.yml b/variables.yml
@@ -2,16 +2,17 @@
 # See also mkdocs.yml plugins.with-pdf.cover_subtitle and output_path
 
 
-release: '7.0.37-20'
+release: '7.0.39-21'
 version: '7.0'
-mongosh: '2.8.3'
+mongosh: '2.9.2'
 
 year: '2026'
 
 product:
   psmdb_full_name:  Percona Server for MongoDB
 
 date:
+  7_0_39: '2026-08-05'
   7_0_37: '2026-06-23'
   7_0_34: '2026-05-20'
   7_0_32: '2026-05-07'