MongoDB Urges Immediate Patching for Severe RCE Vulnerability CVE-2025-14847

MongoDB has issued a warning regarding a high-severity vulnerability tracked as CVE-2025-14847, which can be exploited for remote code execution (RCE) attacks. This vulnerability affects various versions of MongoDB, including 8.2.0 through 8.2.3, 8.0.0 through 8.0.16, 7.0.0 through 7.0.26, and earlier versions down to 4.4.0. The flaw arises from improper handling of length parameter inconsistencies, allowing unauthenticated attackers to execute arbitrary code.

The security advisory emphasizes the importance of upgrading to fixed versions, specifically MongoDB 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, or 4.4.30, to prevent potential exploitation. MongoDB’s security team strongly recommends this action, citing that the vulnerability can be exploited without user interaction, making it particularly dangerous.

Why This Matters for Your Security

This vulnerability is not the first for MongoDB; the U.S. Cybersecurity and Infrastructure Security Agency (CISA) previously added another MongoDB RCE flaw, CVE-2019-10758, to its catalog of known exploited vulnerabilities. This highlights a pattern of vulnerabilities within MongoDB that can be actively exploited, posing risks to organizations using this database management system.

With over 62,500 customers globally, including numerous Fortune 500 companies, the impact of this vulnerability could be significant. Organizations using affected versions of MongoDB should prioritize patching to safeguard their systems against potential attacks.

In addition to upgrading, MongoDB advises disabling zlib compression on the server if immediate upgrades are not feasible. This precaution can help mitigate risks until the software can be updated.

Organizations should remain vigilant about their database security practices, ensuring that they are using the latest versions and monitoring for any unusual activity that could indicate exploitation attempts.

• MongoDB 8.2.0 through 8.2.3 – Affected by the vulnerability allowing RCE attacks.
• MongoDB 8.0.0 through 8.0.16 – Vulnerable versions that need immediate patching.
• MongoDB 7.0.0 through 7.0.26 – Includes versions at risk of exploitation.
• MongoDB 6.0.0 through 6.0.26 – Older versions that are also vulnerable.
• MongoDB 5.0.0 through 5.0.31 – Users must upgrade to secure their systems.
• MongoDB 4.4.0 through 4.4.29 – Affected versions requiring immediate attention.
• All MongoDB Server v4.2 versions – Vulnerable and should be patched.
• All MongoDB Server v4.0 versions – At risk and need updates.
• All MongoDB Server v3.6 versions – Also impacted by this vulnerability.