Threat Brief: MongoDB Vulnerability (CVE-2025-14847)

MongoDB’s MongoBleed vulnerability (CVE-2025-14847) is a critical, unauthenticated memory-disclosure flaw in how the server handles zlib-compressed wire-protocol messages, enabled by default, meaning an attacker only needs network access to the default MongoDB port to trigger it.

In practice, an attacker can send specially crafted compressed messages, manipulate the uncompressedSize field, and cause the server to allocate an oversized memory buffer that can reveal uninitialised heap memory and other sensitive data such as credentials, API keys, sessions and PII.

The threat is not hypothetical; a public PoC exploit appeared on GitHub on 26 December 2025 and active exploitation was observed soon after disclosure, with official confirmation by CISA on 29 December 2025 when the vulnerability was added to the KEV Catalog. Cortex Xpanse identified approximately 146,000 vulnerable MongoDB instances exposed to the internet.

According to Unit 42, managed patches were applied for MongoDB Atlas, but self-hosted instances require manual patching, and Palo Alto Networks offers protections across XDR, XSIAM, Cortex Cloud and Cortex Xpanse to help detect and mitigate exploitation.