MongoDB Vulnerability CVE-2025-14847 Under Active Exploitation Worldwide

A recently disclosed security vulnerability in MongoDB, CVE-2025-14847, has come under active exploitation worldwide, with more than 87,000 potentially susceptible instances identified across the world. The flaw, CVSS 8.7 and nicknamed MongoBleed, allows an unauthenticated attacker to remotely leak sensitive data from the MongoDB server memory by exploiting a zlib-based decompression weakness.

Data from attack surface management company Censys shows that there are over 87,000 potentially vulnerable instances, with a majority located in the U.S., China, Germany, India and France, and Wiz notes that 42% of cloud environments have at least one vulnerable MongoDB instance.

The vulnerability arises from a flaw in the zlib-based network message decompression logic, which can enable an unauthenticated attacker to send malformed, compressed packets to trigger the issue and access uninitialized heap memory, with Internet-exposed servers being particularly at risk.

Users are advised to update to MongoDB versions 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32 and 4.4.30, while temporary mitigations include disabling zlib compression and restricting network exposure, as well as monitoring logs for pre-authentication connections. According to Wiz, the vulnerability also affects the Ubuntu rsync package, and patches for MongoDB Atlas have been applied.