Cybersecurity authorities in the United States and Australia have issued urgent warnings that a critical flaw in the widely used MongoDB database platform is being actively exploited in the wild, exposing sensitive information from unpatched systems.

Known as ‘‘MongoBleed’’ and tracked as CVE-2025-14847, the vulnerability arises from a defect in MongoDB Server’s zlib compression handling, which allows unauthenticated remote attackers to trigger unintended memory disclosure and extract uninitialized data directly from server memory.

This combination of high severity and exploitability has prompted heightened alerts and remediation guidance from national cyber agencies.

The Australian Cyber Security Centre, part of the Australian Signals Directorate, confirmed that its monitoring indicates active exploitation of the MongoBleed vulnerability affecting MongoDB instances exposed online.

It advised organisations to apply the latest vendor patches immediately, investigate for signs of compromise and mitigate exposure by restricting network access and disabling zlib compression where feasible.

Similar guidance has been echoed by U.S. counterparts, including the Cybersecurity and Infrastructure Security Agency, which added the flaw to its catalog of actively exploited vulnerabilities and set deadlines for federal agencies to patch vulnerable systems.

Security researchers report that public proof-of-concept exploit code has been released, lowering the barrier for attackers to identify and abuse the flaw.

The exploit works by sending crafted compressed network packets that trick MongoDB into allocating and returning uninitialized heap memory, potentially revealing credentials, session tokens and other private data without authentication.

Internet scanning platforms have identified tens of thousands of MongoDB instances running vulnerable versions, underscoring the scale of the potential attack surface.

MongoDB has already issued patched releases that address the flaw for recent supported versions, and fully managed MongoDB Atlas cloud services have been updated automatically.

Cyber experts stress that organisations must prioritise patch application and monitoring, particularly for databases exposed to the public internet, while also using detection tools and network restrictions to mitigate ongoing exploitation attempts.

The active exploitation warnings from both U.S. and Australian authorities reflect an intensifying global focus on database security and highlight the risks posed by widely deployed open-source infrastructure when critical vulnerabilities are disclosed and weaponised swiftly by attackers.