CVE-2026-93765
Raw vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-93765 is a high-severity Unsafe Reflection (CWE-470) vulnerability in Mongodb (inferred from references). Its CVSS base score is 8.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Reflective Code Loading (T1620); ranked at the 41th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-83190
Vulnerability Data
Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. Input whose keys are passed through from an unauthenticated party by an embedding application can cause unintended internal method invocation instead of the intended…
more
array field update. This may result in unintended removal of stored records and in the embedding application becoming unresponsive.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces authorization checks on the code or classes ultimately invoked, blocking unauthorized selections even if reflection is used.
Limits privileges of any code reached through unsafe reflection, reducing blast radius without stopping the selection itself.
Input validation directly stops externally supplied class or method names from selecting improper code via reflection.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Vulnerability identification processes can discover unsafe reflection during code review or scanning.
Preventing execution of unauthorized code can block exploitation of unsafe reflection at runtime.
Secure SDLC practices directly avoid introducing externally controlled class selection via reflection.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure development lifecycle mandates input validation and design reviews that reduce unsafe reflection risks.
Application security requirements can explicitly prohibit or constrain reflection based on untrusted input.
Secure architecture principles discourage dynamic class loading from external data sources.
Secure coding standards directly forbid unsafe reflection and require whitelisting or static alternatives.
Security testing can detect and block unsafe reflection patterns before release.