CISA orders feds to patch MongoBleed flaw exploited in attacks

MongoBleed (CVE-2025-14847) is a high-severity MongoDB vulnerability that stems from how MongoDB Server processes network packets using the zlib library for data compression. Successful exploitation allows unauthenticated threat actors to remotely steal credentials and sensitive data through low-complexity attacks that don't require user interaction. Over 74,000 Internet-exposed, potentially vulnerable MongoDB instances were found by Shadowserver, with Censys tracking over 87,000 IP addresses running possibly unpatched MongoDB versions. According to Wiz telemetry, 42% of visible cloud systems have at least one MongoDB instance vulnerable to this flaw.