InfoSecBulletin Cybersecurity for mankind
BGD e-GOV CIRT found 80 insecure MongoDB databases in Bangladesh exposed online, affected by the CVE-2025-14847 vulnerability (MongoBleed). This critical flaw allows remote attackers to access sensitive server data when zlib compression is enabled.
MongoDB is often used to store personal, financial, and operational information. This exposure poses significant risks to data protection and public confidence in digital services in Bangladesh.
Daily Cyber security update for 25. 10. 2026
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
Vulnerability Overview: CVE-2025-14847
The critical security flaw, CVE-2025-14847, has been discovered in both MongoDB Community and Enterprise versions. It stems from poor access control and insecure settings, posing a risk of unauthorized remote access from untrusted networks.
The vulnerability affects network-exposed MongoDB services on TCP port 27017. Often, no authentication is needed or the authentication is weak, raising the risk of being compromised.
CIRT advises that to manage the risk of CVE-2025-14847, organizations using MongoDB should strengthen security immediately. MongoDB should not be publicly accessible and should only bind to localhost or trusted internal IPs. Strong authentication and access controls should be applied by enabling authorization, removing unused accounts, and following the least privilege principle. Organizations should upgrade to the latest patched MongoDB version and ensure all vendor fixes are implemented. In addition, network protections must restrict database access to trusted servers and block public connectivity through firewalls and ACLs.
