U.S. CISA adds a flaw in MongoDB Server to its Known Exploited Vulnerabilities catalog

According to CISA, the U.S. Cybersecurity and Infrastructure Security Agency added a MongoDB Server vulnerability, tracked as CVE-2025-14847 (CVSS Score 8.7), to its Known Exploited Vulnerabilities catalog. The flaw, also known as MongoBleed, is being actively exploited, with more than 87,000 potentially vulnerable instances identified worldwide.

A proof-of-concept exploit for this vulnerability exists, enabling unauthenticated attackers to leak sensitive server memory and, in effect, to potentially execute arbitrary code on vulnerable servers. The advisory notes that the issue stems from the zlib decompression path and affects public and reachable private MongoDB instances, with exploitation able to lead to gradual extraction of data such as user details, passwords and API keys.

Affected MongoDB versions range from 4.0 to 8.2 across multiple streams, and versions 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32 and 4.4.30 have been addressed. Since the discovery, private organisations have been urged to upgrade or, if upgrading is not feasible, to disable zlib by adjusting networkMessageCompressors or net.compression.compressors. CISA also requires federal agencies to fix the vulnerabilities by 19 January 2026.