CVE-2025-14847

highpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.832 · 100 %ileexploit · functionalCHDEEUNLRUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 42 exploits · functional

Likely / severe?

83.2% (100th) EPSS

CVSS 7.5 · high

Is it mine?

61 products

Check your exposure

Who says so?

8 sources

cnnvd · enisa_euvd · fstec_bdu · abb_psirt

added 2025-12-29remediate by 2026-01-19

required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

EPSS · scored 2026-10-23

MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability

Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

No vendor fix yet; a mitigation is available.

MitigationIIoT services with MongoDB 4.2 installed on ABB Ability Zenon /allabb_psirt
ABB recommends the following mitigation measures: - Replace bundled MongoDB with a supported version if IIoT services are required: - Where IIoT functionality is required, the bundled MongoDB instance can be replaced with a supported and patched version through manual configuration. - The following zenon online help section explains the process of installing and using your own MongoDB database: zenHelpViewer - Uninstall IIoT Services wherever it’s not required: - If IIoT Services are not required, they can be removed using the Control panel uninstaller. This eliminates the dependency on MongoDB without affecting other zenon components. Refer to section “General security recommendations” for further advise on how to keep your system secure.
MitigationIIoT services with MongoDB 4.2 installed on ABB Ability Zenon /allcisa_csaf_ot
ABB recommends the following mitigation measures: - Replace bundled MongoDB with a supported version if IIoT services are required: - Where IIoT functionality is required, the bundled MongoDB instance can be replaced with a supported and patched version through manual configuration. - The following zenon online help section explains the process of installing and using your own MongoDB database: zenHelpViewer - Uninstall IIoT Services wherever it’s not required: - If IIoT Services are not required, they can be removed using the Control panel uninstaller. This eliminates the dependency on MongoDB without affecting other zenon components. Refer to section “General security recommendations” for further advise on how to keep your system secure.

cvss

Technical severity, 0–10. One row per scoring source.

8.7

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · NCSC-NL NL

v3.17.5highAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · FSTEC (BDU) RU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · cna@mongodb.comexploitability 3.9 · impact 3.6

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:F/RL:U/RC:Csecondary · ABB PSIRT

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:F/RL:U/RC:Csecondary · CISA US

v4.08.7highCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:Nsecondary · ENISA EU

v4.08.7highCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · cna@mongodb.com

v4.08.7highCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-130USCWE-130USCWE-130USCWE-130USCWE-130US

exploits (42)

Public proof-of-concept and weaponised exploit code.

auxiliary/scanner/mongodb/cve_2025_14847_mongobleedMongoDB Memory Disclosure (CVE-2025-14847) - Mongobleedfunctional · metasploit
0xBlackash/CVE-2025-14847CVE-2025-14847PoC · poc_in_github
14mb1v45h/CYBERDUDEBIVASH-MONGODB-DETECTOR-v2026Detect exposed MongoDB instances and CVE-2025-14847 "MongoBleed" risks — Zero-Trust Python scannerPoC · poc_in_github
AdolfBharath/mongobleedCVE-2025-14847 explaination and lab PoC · poc_in_github
Black1hp/mongobleed-scannerMongoDB CVE-2025-14847 Heap Memory Leak Scanner | OP_COMPRESSED zlib Vulnerability | Bug Bounty & Red Team ToolPoC · poc_in_github
CadGoose/MongoBleed-CVE-2025-14847-Fully-Automated-scannerFull automation check for CVE-2025-14847 MonogBleed- Finds origin IP and tests for exploit.PoC · poc_in_github

affected products (61)

Products and version ranges known to be affected.

IIoT services with MongoDB 4.2 installed on ABB Ability Zenon /allall versionsabb_psirtCH
Commvault Backup & Recovery <11.32.129all versionscert_bundDE
Commvault Backup & Recovery <11.36.90all versionscert_bundDE
Commvault Backup & Recovery <11.40.37all versionscert_bundDE
Open Source MongoDB <4.4.30all versionscert_bundDE
Open Source MongoDB <5.0.32all versionscert_bundDE
Open Source MongoDB <6.0.27all versionscert_bundDE
Open Source MongoDB <7.0.28all versionscert_bundDE
Open Source MongoDB <8.0.17all versionscert_bundDE
Open Source MongoDB <8.2.3all versionscert_bundDE
Splunk Splunk Enterprise <10.0.3all versionscert_bundDE
Splunk Splunk Enterprise <10.2.0all versionscert_bundDE
Splunk Splunk Enterprise <9.2.12all versionscert_bundDE
Splunk Splunk Enterprise <9.3.9all versionscert_bundDE
Splunk Splunk Enterprise <9.4.8all versionscert_bundDE
Ubuntu Linuxall versionscert_bundDEcpe:/o:canonical:ubuntu_linux:-
Commvault Backup & Recovery< 11.32.129cert_bundDE
Commvault Backup & Recovery< 11.36.90cert_bundDE
Commvault Backup & Recovery< 11.40.37cert_bundDE
Open Source MongoDB< 4.4.30cert_bundDE

showing 20 of 61

advisories (5)

Vendor and ecosystem advisories describing this.

9AKK108472A9037ABB AbilityTM zenon Security Risk Due to End-of-Life MongoDB Component2026-07-30csaf · abb_psirtCH
ABB is aware of publicly reported vulnerabilities affecting MongoDB 4.2, which is bundled within the IIoT Services of the affected product versions. MongoDB 4.2 has reached end-of-life and contains multiple known security vulnerabilities. An attacker who successfully exploits these vulnerabilities could potentially access sensitive information, cause denial of service, or disrupt system availability.
NCSC-2025-0402Kwetsbaarheid verholpen in MongoDBNL2025-12-27csaf · ncsc_nlNL
De ontwikkelaars van MongoDB hebben een kwetsbaarheid verholpen in MongoDB.
WID-SEC-W-2025-2905MongoDB: Schwachstelle ermöglicht Offenlegung von InformationenDeutsch2025-12-18csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in MongoDB ausnutzen, um Informationen offenzulegen.
ICSA-26-218-01ABB Ability Zenon2026-07-30icsa · cisa_csaf_otUS
ABB is aware of publicly reported vulnerabilities affecting MongoDB 4.2, which is bundled within the IIoT Services of the affected product versions. MongoDB 4.2 has reached end-of-life and contains multiple known security vulnerabilities. An attacker who successfully exploits these vulnerabilities could potentially access sensitive information, cause denial of service, or disrupt system availability.
BIT-mongodb-2025-14847Zlib compressed protocol header length confusion may allow memory read2025-12-19vendor · osvUS
Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu abb_psirt cert_bund ncsc_nl cisa_csaf_ot osv NVD CVE.org MITRE

published 2025-12-19modified 2026-06-17

references (10)

External citations — patches, advisories, analysis.

https://access.redhat.com/security/cve/cve-2025-14847 cnnvd
https://jira.mongodb.org/browse/SERVER-115508 cnnvd
https://vigilance.fr/vulnerability/MongoDB-Server-out-of-bounds-memory-reading-via-Zlib-Compressed-Protocol-Headers-49179 cnnvd
https://jira.mongodb.org/browse/SERVER-115508 enisa_euvd
http://www.openwall.com/lists/oss-security/2025/12/29/21Mailing Listnvd
https://jira.mongodb.org/browse/SERVER-115508Issue TrackingPatchVendor Advisorynvd
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-14847Third Party AdvisoryUS Government Resourcenvd
https://www.smartkeyss.com/post/mongobleed-pre-auth-memory-disclosure-via-op_compressed-in-mongodb-cve-2025-14847Technical DescriptionThird Party Advisorynvd

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan