Loading story…
US and Australian cybersecurity agencies warned that MongoBleed (CVE-2025-14847) in MongoDB is being actively exploited, describing an unauthenticated memory disclosure issue that can leak heap data from exposed servers. Public reporting and advisory material indicate the flaw is tied to zlib decompression behavior and can expose sensitive information from MongoDB process memory, raising the risk of credential theft and follow-on compromise where internet-accessible instances are affected.
The warning was followed by a rapid surge of public GitHub repositories publishing proof-of-concept exploits, scanners, detection scripts, and lab environments for CVE-2025-14847. These tools advertise capabilities including external and container-based scanning, memory extraction, credential parsing, CIDR and batch targeting, and exploitation detection, lowering the barrier for both defenders validating exposure and attackers seeking vulnerable MongoDB deployments.
See which actors are running it and whether you're in range.
9 events from the most recent confirmed update back to the earliest known activity.
An additional GitHub repository for CVE-2025-14847 exploitation was published, showing the vulnerability continued to attract public exploit development months after initial disclosure and warnings.
A more feature-rich GitHub toolkit for CVE-2025-14847 was published, advertising scanning, exploitation, memory extraction, credential parsing, CIDR or batch scanning, and Nuclei templates. This marked a further maturation of public tooling around MongoBleed.
New GitHub projects published a MongoBleed proof-of-concept exploit and a dedicated detection script for exploitation. These releases provided both offensive validation and defender-oriented detection capability.
A GitHub repository specifically describing CVE-2025-14847 as an unauthenticated MongoDB memory-leak exploit was published, adding to the growing set of public exploit implementations.
Multiple additional GitHub repositories for CVE-2025-14847 were published, including discovery and detection tooling as well as exploit-focused projects. This broadened public availability of offensive and defensive tooling around MongoBleed.
Government-linked reporting and an ACSC advisory warned that the MongoDB vulnerability CVE-2025-14847, dubbed MongoBleed, was under active exploitation. The advisory framed the issue as a MongoDB server memory leak requiring defensive attention.
Another GitHub repository for CVE-2025-14847 / MongoBleed was published, showing continued spread of public exploit material shortly after the initial code appeared.
A GitHub repository containing MongoBleed exploit code for CVE-2025-14847 was published, indicating public weaponization of the MongoDB memory leak issue. Another GitHub-hosted mongobleed.py exploit file also appeared the same day.
A further GitHub exploit project for CVE-2025-14847 was published, describing a Python script to leak sensitive MongoDB heap memory and analyze responses for newly disclosed data.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
14 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
MongoDB patched a high-severity information disclosure vulnerability, **CVE-2025-14847** or **MongoBleed**, that allows a remote unauthenticated attacker to read sensitive heap memory from vulnerable servers. The flaw affects `OP_COMPRESSED` messages using `zlib`: by manipulating the BSON `uncompressedSize` field, an attacker can make MongoDB allocate an oversized buffer without validating the claimed length, which can cause the server to return uninitialized memory. Researchers said the leak can expose cleartext passwords, credentials, API keys, and other secrets, and can be amplified when a malformed BSON object omits a null terminator, causing MongoDB to continue parsing memory until a null byte is found and include leaked contents in an error response. The vulnerability has been reported as **actively exploited**, and public proof-of-concept code is available. Affected releases include MongoDB Server 8.2 before 8.2.3, 8.0 before 8.0.17, 7.0 before 7.0.28, 6.0 before 6.0.27, 5.0 before 5.0.32, 4.4 before 4.4.30, and all versions of 4.2, 4.0, and 3.6. Defenders were urged to upgrade immediately, disable `zlib` request compression until patching is complete, restrict Internet exposure of TCP port `27017`, review logs for exploitation attempts, and rotate passwords and cryptographic material that may have been exposed. Researchers also warned that internet-scale exposure could be significant, citing tens of thousands to more than 200,000 internet-accessible MongoDB instances identified by scanning services.
Jul 24, 2026
A critical vulnerability, CVE-2025-14847, known as MongoBleed, has been discovered in MongoDB, allowing unauthenticated remote attackers to read uninitialized heap memory from affected servers when zlib compression is enabled. This flaw exposes sensitive in-memory data such as credentials, session tokens, and application secrets, and is present across a wide range of MongoDB versions. The vulnerability is actively being exploited, with CISA adding it to the Known Exploited Vulnerabilities (KEV) catalog and warning that over 80,000 servers are at risk. The attack requires no authentication or user interaction, making it a high-severity issue for organizations using MongoDB in cloud, SaaS, and enterprise environments. The MongoBleed vulnerability has reportedly been linked to a major breach in Ubisoft's Rainbow Six Siege, where attackers exploited the flaw to manipulate in-game assets, resulting in the unauthorized distribution of billions of in-game credits and random moderation actions. Ubisoft responded by shutting down game servers and rolling back transactions, though the company has not officially confirmed MongoBleed as the root cause. The incident highlights the real-world impact of MongoDB vulnerabilities on high-profile applications and underscores the urgent need for organizations to apply mitigations and monitor for exploitation attempts.
Jun 29, 2026
A critical vulnerability in MongoDB, identified as CVE-2025-14847 and dubbed 'MongoBleed,' has been publicly disclosed, with a proof-of-concept (PoC) exploit released. The flaw resides in MongoDB's use of the `zlib` compression library, allowing unauthenticated attackers to send specially crafted messages that cause the server to leak fragments of its internal memory. This memory leak can expose sensitive data such as clear-text passwords, login keys, personal information, and security tokens, all without requiring authentication. The impact of this vulnerability became immediately apparent when Ubisoft was forced to shut down its popular game, Rainbow Six Siege, after attackers exploited MongoBleed to compromise player accounts and internal systems. Thousands of gamers were locked out as a result, highlighting the real-world risks posed by the flaw. Security researchers have confirmed that multiple hacker groups are actively leveraging the PoC to target organizations using vulnerable MongoDB instances, emphasizing the urgent need for patching and mitigation.
Jun 29, 2026