CVE-2026-25612
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-25612 is a high-severity Unrestricted Externally Accessible Lock (CWE-412) vulnerability in Mongodb (inferred from references). Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 10th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-6765
Vulnerability Data
The internal locking mechanism of the MongoDB server uses an internal encoding of the resources in order to choose what lock to take. Collections may inadvertently collide with one another in this representation causing unavailability between them due to conflicting…
more
locks.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Access enforcement directly stops external actors from reaching or influencing an internal lock mechanism.
Least privilege limits which subjects may ever touch the lock, reducing the chance of external influence.
Boundary protection prevents external traffic from reaching or manipulating an internally scoped lock.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Enforcing least-privilege authorization policies directly prevents external actors from acquiring or influencing locks.
Logical access controls and segmentation stop unintended external influence over synchronization primitives.
Vulnerability identification processes can discover externally controllable locks before deployment.
Hardened configuration baselines can disable or restrict external lock exposure by default.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Restricting privileged utilities can limit external lock manipulation but does not address the core weakness.
Privileged access rights limit who can create or manipulate locks, reducing external influence.
Network security measures can block external access paths to locks but do not address the design flaw itself.
Secure development lifecycle practices can prevent introducing externally controllable locks during design.
Application security requirements can mandate that locks remain within the intended control sphere.
Secure architecture principles discourage exposing lock mechanisms to external actors.