Loading story…
A critical vulnerability, CVE-2025-14847, known as MongoBleed, has been discovered in MongoDB, allowing unauthenticated remote attackers to read uninitialized heap memory from affected servers when zlib compression is enabled. This flaw exposes sensitive in-memory data such as credentials, session tokens, and application secrets, and is present across a wide range of MongoDB versions. The vulnerability is actively being exploited, with CISA adding it to the Known Exploited Vulnerabilities (KEV) catalog and warning that over 80,000 servers are at risk. The attack requires no authentication or user interaction, making it a high-severity issue for organizations using MongoDB in cloud, SaaS, and enterprise environments.
The MongoBleed vulnerability has reportedly been linked to a major breach in Ubisoft's Rainbow Six Siege, where attackers exploited the flaw to manipulate in-game assets, resulting in the unauthorized distribution of billions of in-game credits and random moderation actions. Ubisoft responded by shutting down game servers and rolling back transactions, though the company has not officially confirmed MongoBleed as the root cause. The incident highlights the real-world impact of MongoDB vulnerabilities on high-profile applications and underscores the urgent need for organizations to apply mitigations and monitor for exploitation attempts.
See which actors are running it and whether you're in range.
9 events from the most recent confirmed update back to the earliest known activity.
On 2025-12-31, ProjectDiscovery updated its Nuclei template for CVE-2025-14847 to make detection deterministic and reduce false negatives. The maintainers said the template was validated against both vulnerable and patched hosts and noted exploitation had been observed in the wild.
On 2025-12-31, a Metasploit pull request introduced a scanner module for CVE-2025-14847 that can test for the flaw and extract leaked memory fragments for analysis. The release made exploitation and validation easier for security teams and potentially for attackers.
On 2025-12-30, Akamai released technical analysis and actionable detection guidance for MongoBleed, including queries and recommendations to identify vulnerable assets. The company emphasized immediate remediation because public exploits were available and active exploitation was ongoing.
By 2025-12-30, CISA had added CVE-2025-14847 to its Known Exploited Vulnerabilities catalog, reflecting confirmed in-the-wild exploitation. One report said more than 80,000 servers were facing active exploitation tied to the flaw.
By 2025-12-28, security reporting described MongoBleed as exploitable over the network without authentication and warned that mass attacks were likely as awareness increased. Subsequent reporting indicated public exploits were available and that more than 200,000 internet-exposed MongoDB instances were potentially at risk.
After the 2025-12-27 breach, Ubisoft responded by taking servers offline, rolling back unauthorized transactions, and telling players they would not be punished for spending illicitly issued credits. As of the reporting, the company had not published a full post-incident analysis or restoration timeline.
On 2025-12-27, Rainbow Six Siege suffered a major breach that allegedly exploited MongoBleed to gain backend access. Attackers distributed billions of in-game credits and items and manipulated moderation systems, with estimated impact exceeding $13 million in virtual currency.
Following disclosure, patched MongoDB releases were made available for affected versions, and defenders were advised to upgrade or disable zlib compression as a temporary mitigation. Guidance also recommended network segmentation and monitoring for signs of memory leakage or unusual traffic.
On 2025-12-19, CVE-2025-14847, dubbed MongoBleed, was disclosed as a critical unauthenticated memory disclosure flaw in MongoDB's handling of zlib-compressed messages. The issue affected a broad range of MongoDB versions and exposed sensitive memory contents such as credentials, tokens, and API keys.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
7 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcegithub.com
Open sourceakamai.com
Open sourcesecurityonline.info
Open sourcebitsight.com
Open sourcerescana.com
Open sourcerescana.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability in MongoDB, identified as CVE-2025-14847 and dubbed 'MongoBleed,' has been publicly disclosed, with a proof-of-concept (PoC) exploit released. The flaw resides in MongoDB's use of the `zlib` compression library, allowing unauthenticated attackers to send specially crafted messages that cause the server to leak fragments of its internal memory. This memory leak can expose sensitive data such as clear-text passwords, login keys, personal information, and security tokens, all without requiring authentication. The impact of this vulnerability became immediately apparent when Ubisoft was forced to shut down its popular game, Rainbow Six Siege, after attackers exploited MongoBleed to compromise player accounts and internal systems. Thousands of gamers were locked out as a result, highlighting the real-world risks posed by the flaw. Security researchers have confirmed that multiple hacker groups are actively leveraging the PoC to target organizations using vulnerable MongoDB instances, emphasizing the urgent need for patching and mitigation.
Jun 29, 2026
MongoDB patched a high-severity information disclosure vulnerability, **CVE-2025-14847** or **MongoBleed**, that allows a remote unauthenticated attacker to read sensitive heap memory from vulnerable servers. The flaw affects `OP_COMPRESSED` messages using `zlib`: by manipulating the BSON `uncompressedSize` field, an attacker can make MongoDB allocate an oversized buffer without validating the claimed length, which can cause the server to return uninitialized memory. Researchers said the leak can expose cleartext passwords, credentials, API keys, and other secrets, and can be amplified when a malformed BSON object omits a null terminator, causing MongoDB to continue parsing memory until a null byte is found and include leaked contents in an error response. The vulnerability has been reported as **actively exploited**, and public proof-of-concept code is available. Affected releases include MongoDB Server 8.2 before 8.2.3, 8.0 before 8.0.17, 7.0 before 7.0.28, 6.0 before 6.0.27, 5.0 before 5.0.32, 4.4 before 4.4.30, and all versions of 4.2, 4.0, and 3.6. Defenders were urged to upgrade immediately, disable `zlib` request compression until patching is complete, restrict Internet exposure of TCP port `27017`, review logs for exploitation attempts, and rotate passwords and cryptographic material that may have been exposed. Researchers also warned that internet-scale exposure could be significant, citing tens of thousands to more than 200,000 internet-accessible MongoDB instances identified by scanning services.
Jul 24, 2026
US and Australian cybersecurity agencies warned that **MongoBleed** (`CVE-2025-14847`) in MongoDB is being actively exploited, describing an unauthenticated memory disclosure issue that can leak heap data from exposed servers. Public reporting and advisory material indicate the flaw is tied to `zlib` decompression behavior and can expose sensitive information from MongoDB process memory, raising the risk of credential theft and follow-on compromise where internet-accessible instances are affected. The warning was followed by a rapid surge of public GitHub repositories publishing proof-of-concept exploits, scanners, detection scripts, and lab environments for `CVE-2025-14847`. These tools advertise capabilities including external and container-based scanning, memory extraction, credential parsing, CIDR and batch targeting, and exploitation detection, lowering the barrier for both defenders validating exposure and attackers seeking vulnerable MongoDB deployments.
Jul 12, 2026