CVE-2026-25613

Mongodb 7.0.0 – 7.0.29

Published

10 February 2026

Modified

25 February 2026

Patch / advisory

View advisory

CVSS Score v4 7.1

Click a component to see what it means

Raw vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0024 15th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-25613 is a high-severity Incorrect Type Conversion or Cast (CWE-704) vulnerability in Mongodb Mongodb. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 15th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-2 (Flaw Remediation) and SI-4 (System Monitoring) — see the control section below for these in your framework.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-6759

Vulnerability Data

An authorized user may disable the MongoDB server by issuing a query against a collection that contains an invalid compound wildcard index.

CWE(s): CWE-704

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

attack.mitre.org →

Why these techniques?

Authorized user query triggers application-level DoS via exploitation of MongoDB index handling flaw (T1499.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-5170Same product: Mongodb Mongodb

CVE-2026-8199Same product: Mongodb Mongodb

CVE-2026-9740Same product: Mongodb Mongodb

CVE-2026-9749Same product: Mongodb Mongodb

CVE-2026-6914Same product: Mongodb Mongodb

CVE-2026-1850Same product: Mongodb Mongodb

CVE-2025-6712Same product: Mongodb Mongodb

CVE-2026-8202Same product: Mongodb Mongodb

CVE-2026-1847Same product: Mongodb Mongodb

CVE-2025-6709Same product: Mongodb Mongodb

Affected Assets

mongodb

7.0.0 — 7.0.29 · 8.0.0 — 8.0.18 · 8.2.0 — 8.2.4

Mitigating Controls

Control response

Prevent

Stop it (NIST 800-53)

SI-2 Flaw Remediation
AC-6 Least Privilege

Detect

Catch it (NIST detect / respond)

SI-4 System Monitoring

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match

prevent

Directly requires timely application of vendor patches that eliminate the type-handling flaw allowing an authorized query on an invalid compound wildcard index to crash the MongoDB server.

SI-4 System Monitoring good match

detect

Requires continuous monitoring of database activity and availability so that queries targeting malformed indexes or resulting server disablement are identified in near real time.

AC-6 Least Privilege partial match

prevent

Enforces least-privilege query permissions so that only the minimal set of users can reach collections containing compound wildcard indexes, reducing the population able to trigger the DoS condition.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match

prevents

Secure SDLC practices directly prevent type-conversion flaws via coding standards, reviews, and testing.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match

detects

Security testing can uncover type-conversion defects before release.

A.8.25 Secure development life cycle partial match

prevents

Secure development lifecycle includes type-safety reviews that reduce incorrect casts.

A.8.26 Application security requirements partial match

prevents

Application security requirements can mandate strong typing and safe casting rules.

A.8.27 Secure system architecture and engineering principles partial match

degrades

Secure architecture principles discourage unsafe type conversions in design.