Skip to main content
The Website Services team at NHS England are testing early designs to understand how you find information. Your views will help us check our ideas work. Sign up to take part in our user research.

CVE-2025-14847 in MongoDB Under Exploitation

A vulnerability in MongoDB could allow a remote attacker to extract secrets, credentials or other sensitive data

Threat ID:
CC-4734
Threat Severity:
Medium
Published:
30 December 2025 9:42 AM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

A vulnerability in MongoDB could allow a remote attacker to extract secrets, credentials or other sensitive data

Threat details

Exploitation of CVE-2025-14847

The US Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-14847 to their Known Exploited Vulnerabilities (KEV) Catalog. A proof-of-concept exploit and technical details for CVE-2025-14847 are publicly available.

The NHS England National CSOC assesses further exploitation as highly likely.

Introduction

MongoDB has released security updates addressing a vulnerability widely being dubbed as 'MongoBleed'. A remote, unauthenticated attacker could exploit this vulnerability to extract secrets, credential, or other sensitive data. The vulnerability is under active exploitation.

  • CVE-2025-14847 - Improper Handling of Length Parameter Inconsistency vulnerability - CVSSv4 Score: 8.7

Remediation advice

Affected organisations are encouraged to review MongoDB Security Advisory SERVER-115508 and apply the relevant updates as soon as possible.

Definitive source of threat updates

Last edited: 30 December 2025 9:42 am