MongoBleed (CVE-2025-14847): the US, China, and the EU are among the top exploited GEOs

MongoBleed (CVE-2025-14847) is a critical vulnerability that lets attackers remotely leak memory from MongoDB Server instances using zlib compression, without authentication. The flaw affects MongoDB deployments using zlib network compression and is exploitable on all MongoDB versions from 3.6 onward if unpatched. Telemetry shows the highest numbers of exposed vulnerable instances in China (16,576) and the United States (14,486), followed by Germany (11,547), Hong Kong (5,521) and Singapore (4,130).

According to Resecurity, the issue appears globally distributed rather than regionally isolated, with additional exposures in India, Russia, France, Vietnam and Indonesia. U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-14847 to its Known Exploited Vulnerabilities catalog, and the Australian Signals Directorate has warned of active global exploitation; remediation for CVE-2025-14847 is expected by 19 Jan.