The U.S. CISA has mandated government agencies to patch the high-severity MongoDB vulnerability, CVE-2025-14847, which is actively exploited in the wild. The flaw allows attackers to remotely steal sensitive data, and over 87,000 MongoDB servers are potentially vulnerable. #MongoBleed #CVE202514847
Keypoints
- The vulnerability CVE-2025-14847 affects MongoDB servers using zlib for data compression.
- Attackers can exploit the flaw to steal credentials, API keys, session tokens, and PII without user interaction.
- Over 87,000 MongoDB instances are identified as potentially unpatched and vulnerable globally.
- CISA has ordered federal agencies to patch the systems within three weeks, by January 19, 2026.
- Defenders are advised to disable zlib compression if immediate patching isn’t possible and to use detection tools for identifying exploits.