MongoBleed flaw actively exploited in attacks in the wild

MongoBleed, a recently disclosed MongoDB flaw tracked as CVE-2025-14847, is being actively exploited and has left more than 87,000 potentially vulnerable instances identified worldwide. According to Censys, most exposed instances are in the U.S., China, Germany, and India. A proof-of-concept exploit published by cybersecurity researcher Joe Desimone demonstrates that unauthenticated attackers can leak uninitialised heap memory by abusing the server’s zlib decompression, effectively enabling remote code execution.

The vulnerability carries a CVSS score of 8.7 and affects multiple MongoDB versions, including 8.2.x, 8.0.x, 7.0.x, 6.0.x, 5.0.x, 4.4.x, and all 4.x and 3.6 series, with patches issued for several of these branches. Security advisories urge upgrading immediately or, if upgrading is not possible, to disable zlib compression by configuring networkMessageCompressors or net.compression.compressors to omit zlib. The first public exploitation reports emerged around 26 December 2025, with ongoing activity noted as of 29 December 2025.