CVE-2025-14847 - PatchNow

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2025-12-19

Added to CISA KEV: 2025-12-29 10 DAYS BETWEEN CVE AND KEV

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review MongoDB logs, check for unauthorized access, verify system integrity, and monitor for unusual database queries or data access patterns
IMMEDIATE: Update to patched MongoDB versions: 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, or 4.4.30 depending on your branch
URGENT: If immediate patching isn't possible, implement network-level controls to restrict MongoDB access to only authorized systems and disable direct internet exposure
Monitor MongoDB connection logs for suspicious connection attempts and unusual protocol traffic patterns
Patch priority: CRITICAL - Apply patches immediately due to active exploitation and no authentication requirement

New MongoDB Flaw Lets Unauthenticated Attackers Read...
"CVE-2025-14847 allows a remote, unauthenticated attacker to trigger a condition in which the MongoDB server may return uninitialized memory from its heap," OP Innovate said. "This could result in the disclosure of sensitive in-memory data, including internal state information, pointers, or other data that may assist an attacker in further exploitation." Found this article interesting?
MongoDB Vulnerability CVE-2025-14847 Under Active Exploitation Worldwide
Successful exploitation of the shortcoming could allow an attacker to extract sensitive information from MongoDB servers, including user information, passwords, and API keys.This includes both internet-exposed and internal resources. The exact details surrounding the nature of attacks exploiting the flaw are presently unknown. Users are advised to update to MongoDB versions 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, and 4.4.30. Patches for MongoDB Atlas have been applied.
Vulnerability Summary for the Week of December 15, 2025 | CISA
Successful exploitation of the vulnerability could allow an attacker with local network access to send a specially crafted URL to access certain administration functions without login credentials.
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2025-14847

🔴 CVE-2025-14847