US, Australia say ‘MongoBleed’ bug being exploited

According to The Record, U.S. and Australian cyber agencies have confirmed that hackers are exploiting a vulnerability that emerged over the Christmas holiday and is affecting data storage systems from MongoDB. The issue drew attention on 25 December when exploit code for CVE-2025-14847 was published, with MongoDB having announced the vulnerability on 15 December and patched it on 19 December.

CISA added the bug to its catalog of exploited vulnerabilities on Monday evening and ordered all federal civilian agencies to patch it by 19 January. A CISA spokesperson declined to answer further questions about what U.S. agencies are doing to protect those who may be impacted.