Threat Brief: MongoDB Vulnerability (CVE-2025-14847)
Summary: MongoDB disclosed CVE-2025-14847, dubbed MongoBleed, on Dec. 19, 2025, a flaw in how MongoDB Server handles zlib-compressed wire-protocol messages that lets unauthenticated attackers leak heap memory before authentication over the default port TCP/27017. A public proof-of-concept exploit appeared on GitHub on Dec. 26, 2025, and CISA added the flaw to its KEV Catalog on Dec. 29, 2025, while Cortex Xpanse counted approximately 146,000 MongoDB instances exposed to the internet.
Key Takeaway: MongoDB patched its managed Atlas customers automatically, but self-hosted servers need manual patching, and roughly 146,000 exposed instances give attackers a large pool to work with. The leak is read-only, but the secrets it exposes can feed further compromise, data exfiltration and lateral movement.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-14847
- Related
- CVE-2025-14847: MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability Known Exploited Vulnerabilities · Dec 29, 2025Mongo Bleed Detector Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026