Loading story…
A critical vulnerability in MongoDB, identified as CVE-2025-14847 and dubbed 'MongoBleed,' has been publicly disclosed, with a proof-of-concept (PoC) exploit released. The flaw resides in MongoDB's use of the zlib compression library, allowing unauthenticated attackers to send specially crafted messages that cause the server to leak fragments of its internal memory. This memory leak can expose sensitive data such as clear-text passwords, login keys, personal information, and security tokens, all without requiring authentication.
The impact of this vulnerability became immediately apparent when Ubisoft was forced to shut down its popular game, Rainbow Six Siege, after attackers exploited MongoBleed to compromise player accounts and internal systems. Thousands of gamers were locked out as a result, highlighting the real-world risks posed by the flaw. Security researchers have confirmed that multiple hacker groups are actively leveraging the PoC to target organizations using vulnerable MongoDB instances, emphasizing the urgent need for patching and mitigation.
See which actors are running it and whether you're in range.
4 events from the most recent confirmed update back to the earliest known activity.
In response to the exploitation, Ubisoft shut down Rainbow Six Siege and its marketplace to contain the breach and began working to roll back fraudulent transactions. The outage was part of the company's incident response to the MongoBleed-related compromise.
Multiple hacker groups exploited MongoBleed to gain unauthorized access affecting Ubisoft's Rainbow Six Siege environment. The incident led to mass account bans and unbans, fraudulent distribution of in-game currency, and unlocking of cosmetic items for players.
A working proof-of-concept exploit for MongoBleed was released publicly, lowering the barrier to exploitation. Reporting said the PoC enabled unauthenticated attacks against vulnerable MongoDB deployments and was followed by a surge in attacks.
The MongoDB vulnerability dubbed MongoBleed, tracked as CVE-2025-14847, was publicly disclosed. The flaw was described as allowing unauthenticated attackers to access or drain memory from affected MongoDB instances via zlib-related behavior, creating denial-of-service and data-exposure risk.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability, CVE-2025-14847, known as MongoBleed, has been discovered in MongoDB, allowing unauthenticated remote attackers to read uninitialized heap memory from affected servers when zlib compression is enabled. This flaw exposes sensitive in-memory data such as credentials, session tokens, and application secrets, and is present across a wide range of MongoDB versions. The vulnerability is actively being exploited, with CISA adding it to the Known Exploited Vulnerabilities (KEV) catalog and warning that over 80,000 servers are at risk. The attack requires no authentication or user interaction, making it a high-severity issue for organizations using MongoDB in cloud, SaaS, and enterprise environments. The MongoBleed vulnerability has reportedly been linked to a major breach in Ubisoft's Rainbow Six Siege, where attackers exploited the flaw to manipulate in-game assets, resulting in the unauthorized distribution of billions of in-game credits and random moderation actions. Ubisoft responded by shutting down game servers and rolling back transactions, though the company has not officially confirmed MongoBleed as the root cause. The incident highlights the real-world impact of MongoDB vulnerabilities on high-profile applications and underscores the urgent need for organizations to apply mitigations and monitor for exploitation attempts.
Jun 29, 2026
US and Australian cybersecurity agencies warned that **MongoBleed** (`CVE-2025-14847`) in MongoDB is being actively exploited, describing an unauthenticated memory disclosure issue that can leak heap data from exposed servers. Public reporting and advisory material indicate the flaw is tied to `zlib` decompression behavior and can expose sensitive information from MongoDB process memory, raising the risk of credential theft and follow-on compromise where internet-accessible instances are affected. The warning was followed by a rapid surge of public GitHub repositories publishing proof-of-concept exploits, scanners, detection scripts, and lab environments for `CVE-2025-14847`. These tools advertise capabilities including external and container-based scanning, memory extraction, credential parsing, CIDR and batch targeting, and exploitation detection, lowering the barrier for both defenders validating exposure and attackers seeking vulnerable MongoDB deployments.
Jul 12, 2026
MongoDB patched a high-severity information disclosure vulnerability, **CVE-2025-14847** or **MongoBleed**, that allows a remote unauthenticated attacker to read sensitive heap memory from vulnerable servers. The flaw affects `OP_COMPRESSED` messages using `zlib`: by manipulating the BSON `uncompressedSize` field, an attacker can make MongoDB allocate an oversized buffer without validating the claimed length, which can cause the server to return uninitialized memory. Researchers said the leak can expose cleartext passwords, credentials, API keys, and other secrets, and can be amplified when a malformed BSON object omits a null terminator, causing MongoDB to continue parsing memory until a null byte is found and include leaked contents in an error response. The vulnerability has been reported as **actively exploited**, and public proof-of-concept code is available. Affected releases include MongoDB Server 8.2 before 8.2.3, 8.0 before 8.0.17, 7.0 before 7.0.28, 6.0 before 6.0.27, 5.0 before 5.0.32, 4.4 before 4.4.30, and all versions of 4.2, 4.0, and 3.6. Defenders were urged to upgrade immediately, disable `zlib` request compression until patching is complete, restrict Internet exposure of TCP port `27017`, review logs for exploitation attempts, and rotate passwords and cryptographic material that may have been exposed. Researchers also warned that internet-scale exposure could be significant, citing tens of thousands to more than 200,000 internet-accessible MongoDB instances identified by scanning services.
Jul 24, 2026