CISA Alert: MongoBleed Added to KEV Catalog as 80,000+ Servers Face Active Exploitation

According to CISA, a critical MongoDB vulnerability dubbed “MongoBleed” has been added to the Known Exploited Vulnerabilities (KEV) Catalog and is being actively exploited to exfiltrate data from servers worldwide. The flaw, tracked as CVE-2025-14847, carries a severity of 8.7 and affects a wide range of MongoDB Server versions, from legacy to modern releases. Censys reported more than 87,000 potentially vulnerable MongoDB instances exposed on the public internet as of 27 December.

The vulnerability stems from an Improper Handling of Length Parameter Inconsistency in the database’s use of the zlib compression library, enabling unauthenticated attackers to harvest secrets and other confidential data from exposed instances. MongoDB has released patches for several versions, including 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32 and 4.4.30, with Atlas customers receiving the patch automatically; for those unable to patch immediately, disabling zlib compression is advised.