---METADATA---
VENDOR: MongoDB
PRODUCT: Server
AFFECTED_VERSIONS: 5.0 up to 5.0.33, 6.0 up to 6.0.28, 7.0 up to 7.0.34, 8.0 up to 8.0.23, 8.2 up to 8.2.9, 8.3 up to 8.3.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An out-of-bounds memory write vulnerability exists in the MongoDB Server time-series collection implementation, potentially allowing authenticated users with write access to disrupt system stability.

Executive Summary:
A critical out-of-bounds memory write vulnerability in MongoDB Server allows authenticated attackers to potentially crash the mongod process or execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-8053

Affected Software: MongoDB Server

Affected Versions: 5.0 up to 5.0.33, 6.0 up to 6.0.28, 7.0 up to 7.0.34, 8.0 up to 8.0.23, 8.2 up to 8.2.9, 8.3 up to 8.3.2

Vulnerability: The flaw is an out-of-bounds write (CWE-787) occurring within the time-series collection handling. It requires an authenticated user with existing database write privileges to trigger the memory corruption.

Business Impact

Successful exploitation poses a severe risk to data availability and system integrity. Given the CVSS score of 8.8, this vulnerability allows an attacker to cause a denial-of-service (process crash) or potentially gain unauthorized control over the database process, leading to full compromise of the underlying data.

Remediation Plan

Immediate Action: Upgrade MongoDB Server to the nearest patched version (e.g., 5.0.33, 6.0.28, 7.0.34, 8.0.23, 8.2.9, or 8.3.2) as specified by the vendor.

Proactive Monitoring: Monitor mongod logs for unexpected process crashes, segmentation faults, or unusual spikes in memory utilization following write operations.

Compensating Controls: Implement strict Role-Based Access Control (RBAC) to limit write privileges exclusively to trusted, essential service accounts to reduce the attack surface.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept repository exists on GitHub.

Analyst Notes: As of May 14, 2026, there is no confirmed active exploitation in the wild. While active exploitation is not observed, the presence of a public proof-of-concept increases the likelihood of opportunistic attacks targeting unpatched instances.

Analyst Recommendation

The severity of this memory corruption vulnerability necessitates immediate attention. Organizations should prioritize patching all MongoDB deployments within their environment to the specified secure versions to prevent potential system instability or unauthorized exploitation.

---METADATA---
VENDOR: Budibase
PRODUCT: Budibase
AFFECTED_VERSIONS: < 3.38.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A missing authorization vulnerability in the Budibase low-code platform allows authenticated users to bypass access controls, potentially resulting in unauthorized data or system modification.

Executive Summary:
An authorization bypass vulnerability in the Budibase platform allows authenticated users to exceed their intended permissions, requiring an immediate upgrade to version 3.38.1.

Vulnerability Details

CVE-ID: CVE-2026-45717

Affected Software: Budibase

Affected Versions: < 3.38.1

Vulnerability: The platform suffers from a missing authorization flaw (CWE-862). An authenticated attacker can exploit this to perform actions without the necessary permissions, compromising the security of the applications built on the platform.

Business Impact

The CVSS score of 8.8 indicates a high severity level. Successful exploitation could lead to unauthorized data modification, deletion, or administrative-level access within the Budibase environment, posing a severe risk to business logic and data integrity.

Remediation Plan

Immediate Action: Upgrade the Budibase server instance to version 3.38.1 or newer immediately.

Proactive Monitoring: Review application logs for unauthorized API calls or unexpected administrative actions performed by standard users.

Compensating Controls: Ensure the Budibase platform is not exposed to the public internet and enforce strict Role-Based Access Control (RBAC) configurations.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 27, 2026, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. There is no confirmed active exploitation in the wild, but users should consider this a high-priority update.

Analyst Recommendation

Given the availability of a proof-of-concept, the risk of exploitation is credible. Administrators must upgrade to version 3.38.1 immediately to close the authorization loophole and protect against unauthorized privilege escalation.

---METADATA---
VENDOR: FastGPT
PRODUCT: AI Agent building platform
AFFECTED_VERSIONS: Prior to 4.14.9.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
FastGPT versions prior to 4.14.9.5 are vulnerable to NoSQL injection in the login endpoint, allowing unauthenticated attackers to bypass authentication and gain administrative access.

Executive Summary:
A critical NoSQL injection vulnerability in FastGPT prior to version 4.14.9.5 allows unauthenticated attackers to bypass password validation and gain full administrative control.

Vulnerability Details

CVE-ID: CVE-2026-40351

Affected Software: FastGPT AI Agent building platform

Affected Versions: Prior to 4.14.9.5

Vulnerability: The login endpoint utilizes insecure TypeScript type assertion, enabling an unauthenticated attacker to inject a MongoDB query operator (e.g., "$ne") into the password field. This forces the database to return a successful authentication result without a valid password.

Business Impact

This vulnerability carries a CVSS score of 9.8, reflecting the ease of exploit and the catastrophic impact of unauthorized administrative access. Successful exploitation could lead to full platform takeover, data exfiltration, and the manipulation of AI agents, causing severe reputational damage and operational disruption.

Remediation Plan

Immediate Action: Update FastGPT to version 4.14.9.5 or higher to implement proper runtime validation of user input.

Proactive Monitoring: Inspect authentication logs for anomalous login attempts, specifically looking for JSON-like syntax or MongoDB query operators in password fields.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common NoSQL injection patterns in request bodies.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of April 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The risk posed by this authentication bypass is extreme. Administrators must apply the provided patch immediately and conduct a thorough audit of account activity to ensure no unauthorized administrative actions were performed during the vulnerable period.

---METADATA---
VENDOR: SimStudio
PRODUCT: SimStudio
AFFECTED_VERSIONS: Versions below 0.5.74
---END_METADATA---

Description Summary:
SimStudio's MongoDB tool endpoints allow unauthenticated attackers to connect to arbitrary MongoDB instances and perform unauthorized data operations due to missing host restrictions.

Executive Summary:
SimStudio versions below 0.5.74 contain unauthenticated MongoDB tool endpoints that can be leveraged by attackers to read, modify, or delete data on reachable MongoDB instances.

Vulnerability Details

CVE-ID: CVE-2026-3431

Affected Software: SimStudio

Affected Versions: Below 0.5.74

Vulnerability: The MongoDB tool endpoints in SimStudio fail to implement authentication or host restrictions. An unauthenticated attacker can provide arbitrary connection parameters to these endpoints, using the server as a proxy to interact with any reachable MongoDB database.

Business Impact

This flaw facilitates unauthorized data access and manipulation, potentially leading to the destruction of critical databases or the theft of sensitive information. The CVSS score of 9.8 indicates a critical risk, as it effectively turns the SimStudio application into a tool for database exploitation.

Remediation Plan

Immediate Action: Upgrade SimStudio to version 0.5.74 or later. Ensure that all database tool endpoints are properly secured behind authentication.

Proactive Monitoring: Inspect network traffic for unusual connections to MongoDB ports (typically 27017) originating from the SimStudio application server.

Compensating Controls: Use firewall rules to restrict the SimStudio server's ability to initiate outbound connections to database ports except for authorized internal targets.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 2, 2026, there is no public information indicating active exploitation. This vulnerability is particularly dangerous because it can be used to pivot into internal database environments.

Analyst Recommendation

The exposure of database management tools without authentication is a high-risk configuration. Organizations must update SimStudio immediately and audit their network architecture to ensure that database services are not unnecessarily exposed to the application layer.

---METADATA---
VENDOR: MongoDB
PRODUCT: BI Connector ODBC Driver
AFFECTED_VERSIONS: 1.0.0 up to (excluding) 1.4.9
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The MongoDB BI Connector ODBC Driver is susceptible to a buffer overflow during metadata retrieval, which may lead to process termination or arbitrary code execution.

Executive Summary:
A memory corruption vulnerability in the MongoDB BI Connector ODBC Driver, rated as critical, poses a risk of arbitrary code execution for affected applications.

Vulnerability Details

CVE-ID: CVE-2026-19001

Affected Software: MongoDB BI Connector ODBC Driver

Affected Versions: 1.0.0 up to (excluding) 1.4.9

Vulnerability: This is an integer overflow vulnerability that results in a buffer overflow when handling excessively long catalog, schema, or object names. This vulnerability does not require prior authentication to trigger if the application exposes the affected metadata retrieval function to external inputs.

Business Impact

Successful exploitation of this flaw could allow an attacker to execute arbitrary code within the context of the calling application, potentially leading to full system compromise. Given the CVSS score of 9.8, the risk to data confidentiality, integrity, and availability is severe, making immediate remediation essential to prevent potential breaches or service disruptions.

Remediation Plan

Immediate Action: Update the MongoDB BI Connector ODBC Driver to version 1.4.9 or later to incorporate the necessary buffer management fixes.

Proactive Monitoring: Review application logs for unexpected termination events or crashes occurring during database metadata retrieval operations.

Compensating Controls: Ensure that applications utilizing this driver implement strict input validation to truncate or sanitize excessively long metadata strings before they reach the driver.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its potential for memory corruption, which is a common vector for reliable code execution attacks.

Analyst Recommendation

Organizations using the MongoDB BI Connector ODBC Driver must prioritize updating to the latest version immediately. The potential for arbitrary code execution in this component represents a critical security risk that should be addressed during the current maintenance cycle to ensure the integrity of the database connection layer.

---METADATA---
VENDOR: MongoDB
PRODUCT: MongoDB Server
AFFECTED_VERSIONS: 8.3.0 up to (excluding) 8.3.8
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A use after free vulnerability in the timeseries bucket lifecycle management of MongoDB Server allows authenticated users with write access to potentially corrupt memory and execute arbitrary code.

Executive Summary:
A high severity use after free vulnerability in MongoDB Server could allow an authenticated user with write privileges to trigger memory corruption, posing a significant risk to system stability and data integrity.

Vulnerability Details

CVE-ID: CVE-2026-18692

Affected Software: MongoDB Server

Affected Versions: 8.3.0 up to (excluding) 8.3.8

Vulnerability: This vulnerability is a use after free condition (CWE-416) occurring within the timeseries bucket lifecycle management. It requires the attacker to be authenticated with write privileges to trigger the flaw.

Business Impact

Successful exploitation of this memory corruption vulnerability can lead to unauthorized code execution or service crashes. Given the CVSS score of 8.8, this represents a high risk to database environments, potentially leading to total system compromise or prolonged operational downtime.

Remediation Plan

Immediate Action: Upgrade all instances of MongoDB Server to version 8.3.8 or later to resolve the memory management defect.

Proactive Monitoring: Review database access logs for unusual write activity or unexpected service restarts that may indicate attempted exploitation.

Compensating Controls: Implement strict role based access control (RBAC) to limit write privileges to only necessary accounts, reducing the attack surface for this vulnerability.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is technically complex, requiring specific conditions within the timeseries processing logic to trigger.

Analyst Recommendation

The high severity of this vulnerability necessitates prompt action. Organizations should prioritize updating their MongoDB Server deployments to the patched version, 8.3.8, to prevent potential memory-based attacks that could lead to full system compromise.

---METADATA---
VENDOR: MongoDB
PRODUCT: MongoDB Server
AFFECTED_VERSIONS: 8.3.0-8.3.7, 8.0.0-8.0.28, 7.0.0-7.0.39
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
MongoDB Server is affected by an algorithm downgrade vulnerability in intra-cluster communication that allows unauthorized influence over authentication mechanism selection.

Executive Summary:
An algorithm downgrade vulnerability in MongoDB intra-cluster communication allows a network-adjacent attacker to force the use of weaker authentication mechanisms, endangering cluster security.

Vulnerability Details

CVE-ID: CVE-2026-18691

Affected Software: MongoDB MongoDB Server

Affected Versions: 8.3.0 up to 8.3.8 (exclusive), 8.0 up to 8.0.29 (exclusive), 7.0 up to 7.0.40 (exclusive)

Vulnerability: This is an algorithm downgrade vulnerability (CWE-757) occurring during intra-cluster connection setup. It allows an attacker with network access to influence the authentication negotiation process between replica set members.

Business Impact

Successful exploitation could permit an attacker to downgrade the security of cluster communications, potentially facilitating unauthorized access to data or control of the database infrastructure. With a CVSS score of 8.8, this flaw represents a significant risk to the confidentiality and integrity of distributed database clusters.

Remediation Plan

Immediate Action: Apply the vendor-provided security updates to the MongoDB Server versions 8.3.8, 8.0.29, or 7.0.40 as applicable to your environment.

Proactive Monitoring: Monitor intra-cluster traffic for anomalous connection attempts or authentication failures that may indicate an attempt to influence negotiation.

Compensating Controls: Ensure that network segmentation is strictly enforced to limit access to the internal cluster communication ports to authorized replica set members only.

Exploitation Status

Public Exploit Available: No (unknown)

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Per CISA's SSVC assessment, there is no confirmed active exploitation, and the technical impact is high.

Analyst Recommendation

This vulnerability impacts the foundational security of MongoDB clusters. Administrators should prioritize patching their database instances to the specified fixed versions to ensure the integrity of authentication negotiations across the cluster.

---METADATA---
VENDOR: MongoDB
PRODUCT: MongoDB Compass
AFFECTED_VERSIONS: 1.38.0 up to (excluding) 1.49.7
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in MongoDB Compass allows users to override connection options during the import process, potentially leading to OS command injection.

Executive Summary:
A critical OS command injection vulnerability in MongoDB Compass allows attackers to execute arbitrary commands by manipulating connection import options.

Vulnerability Details

CVE-ID: CVE-2026-14881

Affected Software: MongoDB MongoDB Compass

Affected Versions: 1.38.0 up to (excluding) 1.49.7

Vulnerability: This vulnerability is an OS command injection flaw (CWE-78) triggered when importing connection files. The application fails to properly neutralize special elements, allowing an attacker to override restricted connection parameters and execute unauthorized commands on the host system.

Business Impact

Successful exploitation of this vulnerability could allow an attacker to gain full control over the host running MongoDB Compass. Given the CVSS score of 7.8, this poses a significant risk to the integrity and availability of local development environments and potentially connected infrastructure. Unauthorized command execution may lead to data exfiltration or the installation of persistent malicious software.

Remediation Plan

Immediate Action: Update MongoDB Compass to version 1.49.7 or later immediately to apply the vendor-provided patch.

Proactive Monitoring: Review system logs for unusual process creation or unauthorized command-line arguments originating from the MongoDB Compass application.

Compensating Controls: Restrict the ability of users to import external connection configuration files from untrusted sources until the software has been updated.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 24, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation is not currently observed, the nature of the flaw makes it highly dangerous if an attacker can convince a user to import a malicious configuration file.

Analyst Recommendation

The severity of this command injection vulnerability necessitates immediate action. Administrators and developers should prioritize updating all instances of MongoDB Compass to version 1.49.7 to prevent potential system compromise and unauthorized remote code execution.

---METADATA---
VENDOR: MongoDB
PRODUCT: MongoDB Server
AFFECTED_VERSIONS: 7.0 up to (excluding) 7.0.39, 8.0 up to (excluding) 8.0.28, 8.2.0 up to (excluding) 8.2.12, 8.3.0 up to (excluding) 8.3.7
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in the MongoDB Server MozJS scripting engine allows authenticated users to read arbitrary files from the host filesystem using the privileges of the mongod process.

Executive Summary:
A high-severity authorization bypass in MongoDB Server allows authenticated attackers to read arbitrary files from the underlying host filesystem, posing a significant risk to data confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-13078

Affected Software: MongoDB Server

Affected Versions: 7.0 up to (excluding) 7.0.39, 8.0 up to (excluding) 8.0.28, 8.2.0 up to (excluding) 8.2.12, 8.3.0 up to (excluding) 8.3.7

Vulnerability: This is a missing authorization vulnerability (CWE-862) within the MozJS scripting engine. An authenticated attacker can leverage a module loading hook to execute JavaScript calls that read files from the host filesystem with the service account privileges of the mongod process.

Business Impact

The ability for an authenticated user to perform arbitrary file reads can lead to the exposure of highly sensitive information, such as server configuration files, environment variables, and stored credentials. This could facilitate lateral movement within the network or provide the necessary components for a full system compromise. With a CVSS score of 7.7, this vulnerability represents a substantial risk to internal data security.

Remediation Plan

Immediate Action: Apply the vendor-provided security patches for the affected MongoDB versions immediately to restrict access to the file system via the scripting engine.

Proactive Monitoring: Monitor database query logs for unusual JavaScript execution patterns or attempts to access system-level directories via the database interface.

Compensating Controls: Restrict access to the database to trusted users only and enforce the principle of least privilege for all service accounts to minimize the potential impact of file system access.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 24, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is effectively constrained by the requirement for authentication, but it remains a significant risk for environments where database users possess extensive privileges.

Analyst Recommendation

Database administrators should prioritize the deployment of the security updates provided by MongoDB. Ensuring that only verified users have access to the database engine and applying current patches will mitigate the risk of unauthorized file disclosure and maintain the security of the host environment.

---METADATA---
VENDOR: MongoDB
PRODUCT: MongoDB Server
AFFECTED_VERSIONS: 7.0 up to 7.0.39, 8.0 up to 8.0.28, 8.2.0 up to 8.2.12, 8.3.0 up to 8.3.7
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A heap-based buffer overflow in MongoDB Server occurs during aggregation pipeline processing when compute mode is enabled, potentially allowing for process termination or memory corruption.

Executive Summary:
A high-severity memory corruption vulnerability in MongoDB Server, triggered by malicious BSON data, could lead to denial of service or unintended system behavior.

Vulnerability Details

CVE-ID: CVE-2026-13072

Affected Software: MongoDB Server

Affected Versions: 7.0 up to 7.0.39, 8.0 up to 8.0.28, 8.2.0 up to 8.2.12, 8.3.0 up to 8.3.7

Vulnerability: This is a heap-based buffer overflow (CWE-122) caused by insufficient validation of externally sourced BSON data during aggregation pipeline processing. This vulnerability can be triggered when compute mode is enabled on a standalone mongod instance.

Business Impact

The vulnerability poses a severe risk to service availability and system stability. An attacker providing crafted BSON data could cause the MongoDB service to crash or potentially achieve arbitrary code execution through heap memory corruption. Given the critical role of database servers, this vulnerability could result in significant downtime or data compromise, justifying its high CVSS score of 8.1.

Remediation Plan

Immediate Action: Upgrade MongoDB Server to the versions specified by the vendor that incorporate the security fix (e.g., 7.0.39, 8.0.28, 8.2.12, 8.3.7).

Proactive Monitoring: Monitor MongoDB error logs and system resource usage for unexpected process crashes or high memory consumption that may indicate exploitation attempts.

Compensating Controls: Ensure that the MongoDB instance is not exposed to the public internet and restrict access to authorized application servers only.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 24, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Memory corruption flaws are complex to exploit but represent a critical security risk.

Analyst Recommendation

Database administrators must prioritize applying the provided patches to their MongoDB environments. Restricting network access to the database server remains a vital defense-in-depth measure against remote exploitation attempts.

---METADATA---
VENDOR: MongoDB
PRODUCT: MongoDB Server
AFFECTED_VERSIONS: 7.0 up to 7.0.39, 8.0 up to 8.0.28, 8.2.0 up to 8.2.12, 8.3.0 up to 8.3.7
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An authentication bypass vulnerability in MongoDB Server allows authenticated users with low privileges to perform unauthorized data reads and writes by exploiting insufficient command parameter validation.

Executive Summary:
A high-severity vulnerability in MongoDB Server permits low-privileged, authenticated users to bypass role-based access controls and modify or view protected data.

Vulnerability Details

CVE-ID: CVE-2026-13059

Affected Software: MongoDB MongoDB Server

Affected Versions: 7.0 up to 7.0.39, 8.0 up to 8.0.28, 8.2.0 up to 8.2.12, 8.3.0 up to 8.3.7

Vulnerability: The vulnerability is a result of improper input validation (CWE-807) within command parameters, which allows an authenticated user to override security decisions enforced by role-based access controls.

Business Impact

This flaw carries a CVSS score of 8.1, reflecting a high risk of data integrity and confidentiality loss. Successful exploitation allows unauthorized users to manipulate sensitive information or bypass security barriers, potentially leading to unauthorized data exfiltration or critical system configuration changes.

Remediation Plan

Immediate Action: Update your MongoDB Server instances to the patched versions: 7.0.39, 8.0.28, 8.2.12, or 8.3.7.

Proactive Monitoring: Review database audit logs for unusual command execution patterns or unauthorized attempts to access collections restricted by role-based policies.

Compensating Controls: Strictly enforce the principle of least privilege for all database users to minimize the impact of a low-privileged account compromise.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 24, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its direct impact on database access controls.

Analyst Recommendation

The ability for a low-privileged user to undermine core security boundaries is a significant risk to database integrity. Organizations should prioritize the upgrade to the specified fixed versions to ensure that role-based access controls remain effective against authenticated threats.

---METADATA---
VENDOR: MongoDB
PRODUCT: Server
AFFECTED_VERSIONS: Unknown
---END_METADATA---

Description Summary:
A use-after-free vulnerability in the MongoDB Server JavaScript engine allows authenticated users to trigger memory corruption.

Executive Summary:
A critical use-after-free vulnerability in MongoDB Server allows authenticated users to potentially achieve information disclosure or denial of service.

Vulnerability Details

CVE-ID: CVE-2026-11933

Affected Software: MongoDB Server

Affected Versions: Unknown

Vulnerability: This vulnerability resides in the server-side JavaScript engine when converting BSON documents to JavaScript arrays. An authenticated user with read privileges who is able to execute server-side JavaScript can trigger the use of already-freed memory.

Business Impact

With a CVSS score of 8.8, this flaw presents a substantial risk to database availability and data confidentiality. By triggering memory corruption, an attacker could force a server crash, leading to a denial of service, or potentially leak sensitive information from the server's memory space, impacting the overall security posture of the database environment.

Remediation Plan

Immediate Action: Apply the latest security patch provided by MongoDB to address the JavaScript engine memory handling flaw.

Proactive Monitoring: Review database audit logs for anomalous server-side JavaScript execution patterns or unexpected server crashes that may indicate exploitation attempts.

Compensating Controls: Restrict permissions to execute server-side JavaScript to only trusted administrative accounts to reduce the attack surface.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of June 12, 2026, a public exploit is available for this vulnerability. While there is no specific confirmation of active exploitation in the wild, the presence of a public exploit significantly increases the risk level.

Analyst Recommendation

The availability of a public exploit necessitates an immediate and prioritized response. Administrators must apply the latest security patches to all affected MongoDB instances to mitigate the risk of unauthorized data access or system instability.

Executive Summary:
A high-severity vulnerability has been identified in multiple products, which could allow an attacker to bypass security controls and access sensitive data. An authenticated but low-privileged user can leverage a specially crafted query to read and potentially modify data they are not authorized to see, posing a significant risk to data confidentiality and integrity.

Vulnerability Details

CVE-ID: CVE-2025-6713

Affected Software: Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability stems from an improper authorization check within the aggregation pipeline feature of the affected products. An authenticated attacker with low-level privileges can construct a specially crafted aggregation pipeline query. When the system processes this malicious pipeline, it fails to properly enforce access controls, allowing the attacker to read and potentially modify data in collections that would normally be restricted, effectively bypassing the intended security model.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.7. Successful exploitation could lead to a significant data breach, exposing sensitive customer information, intellectual property, or internal corporate data. The ability for an attacker to not only read but also potentially modify data (High Confidentiality and Integrity impact) poses a severe risk. This could result in regulatory fines (e.g., under GDPR, CCPA), reputational damage, loss of customer trust, and operational disruption if critical data is altered.

Remediation Plan

Immediate Action: Organizations should prioritize applying the security patches provided by the vendor across all affected products as soon as possible. Refer to the vendor's security advisory for specific patch information and installation instructions.

Proactive Monitoring: Monitor application and database logs for unusual or overly complex aggregation pipeline queries, particularly those originating from low-privileged user accounts. Implement alerts for frequent access denial errors, which could indicate reconnaissance or exploitation attempts. Analyze user access patterns for anomalies, such as an account suddenly accessing data collections or fields outside its normal scope of operations.

Compensating Controls: If patching is not immediately feasible, consider restricting or disabling the use of complex aggregation features for non-essential or low-privileged users. Implement a Database Firewall or Web Application Firewall (WAF) with rules designed to inspect and block known malicious pipeline structures. Enforce the principle of least privilege by reviewing and ensuring user accounts only have the absolute minimum permissions required for their roles.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of today's date, there are no known public exploits or active exploitation campaigns targeting this vulnerability. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. However, given the nature of authorization bypasses, private exploits could be developed and used by threat actors in targeted attacks.

Analyst Recommendation

Given the High severity rating (CVSS 7.7) and the potential for a significant data breach, we strongly recommend that organizations identify all affected products within their environment and apply the vendor-supplied patches on an expedited basis. While this vulnerability is not currently listed in the CISA KEV catalog, its high impact on data confidentiality and integrity makes it an attractive target for attackers. Proactive patching is the most effective defense and should be treated as a high priority.