https://www.mongodb.com/company/blog/news/mongodb-server-security-update-december-2025 MongoDB EventMongoDB.local SF, Jan 15: See the speaker lineup & ship your AI vision faster. Use WEB50 to save 50% > AnnouncementLearn why MongoDB was named a Leader in the 2025 Gartner(r) Magic Quadrant(tm) Learn more > MongoDB logo [ ] General Information * General Information * Documentation * Developer Articles & Topics * Community Forums * Blog * University search icon * Products Platform atlas_product_familyAtlasBuild and scale with an AI-ready platform Platform Services atlas_databaseDatabaseDeploy a multi-cloud databaseatlas_search SearchDeliver engaging search experiencesmdb_vector_searchVector SearchDesign intelligent apps with gen AIatlas_stream_processing Stream ProcessingIntegrate MongoDB and Kafka Self Managed enterprise_advanced_product familyEnterprise AdvancedRun and manage MongoDB yourselfcommunity_edition_product_familyCommunity EditionDevelop locally with MongoDB Tools mdb_compassCompassWork with MongoDB data in a GUI atlas_integrationIntegrationsIntegrations with third-party servicesmdb_migratorRelational MigratorMigrate to MongoDB with confidence View All ProductsExplore our full developer suite MongoDB 8.0Our fastest version ever Build with MongoDB Atlas Get started for free in minutes Sign Up Test Enterprise Advanced Develop with MongoDB on-premises Download Try Community Edition Explore the latest version of MongoDB Download * Resources general_action_readDocumentationLearn how to build with MongoDB and get started todaymisc_achievementSkills and Certifications Develop in-demand skills and earn MongoDB certifications general_content_ebookBooksRead books and e-books about MongoDB general_content_tutorialMongoDB for EducatorsTake advantage of educator resourcesgeneral_content_learnMongoDB for StudentsTake advantage of student benefitsgeneral_events_ask_the_experts CommunityJoin a community of developersgeneral_events_session Events and WebinarsFind an event or webinar near you Resources HubGet help building the next big thing with MongoDB * Solutions Use cases Artificial IntelligenceModernizationPaymentsServerless DevelopmentGamingIntelligent SearchEdge and Mobile Industries Financial ServicesTelecommunicationsHealthcareRetailPublic SectorManufacturing Solutions LibraryOrganized and tailored solutions to kick-start projects MongoDB AMP Modernize applications up to 3x faster Learn more Startups and AI Innovators For world-changing ideas and AI pioneers Learn more Customer Case Studies Hear directly from our users See stories * Company CareersStart your next adventureBlogRead articles and announcementsNewsroomRead press releases and news stories PartnersLearn about our partner ecosystemLeadershipMeet our executive teamCompanyLearn more about who we are Contact Us Reach out to MongoDB Connect with an expert Investors Visit our investor portal Learn more * Pricing Search Language Selector IconEng SupportSign In Get Started MongoDB logo Search Blog home MongoDB Server Security Update, December 2025 December 29, 2025 At MongoDB, protecting our customers' data is our highest priority. On December 12, 2025, the MongoDB Security Engineering team identified a security vulnerability, described in CVE-2025-14847, which impacts MongoDB Server. Within the security community, this vulnerability is informally referred to as "Mongobleed." This blog post outlines the situation, our immediate response, and the key insights we've gathered so far. Security is an ongoing responsibility in modern software development for both software producers and consumers, and maintaining trust depends on how issues are identified, addressed, and communicated. This patched security vulnerability in the MongoDB Server products (Community and Enterprise) is not a breach or compromise of MongoDB, MongoDB Atlas (our managed MongoDB Server offering), or our systems. To maintain the highest levels of security, customers and users are advised to use the latest versions of MongoDB's software that have been updated to address this vulnerability. The vulnerability was discovered internally by MongoDB Security Engineering as part of our proactive and continuously evolving security program. Over the last several years, we have increased our investment in people, processes, and technology to analyse and improve our codebase continuously. This work is ongoing, and discoveries like this reinforce the importance of sustained focus in this area. Because how and when we act matters as much as what we do, transparency around timing is important. The following timeline outlines our discovery, validation, remediation, and disclosure efforts from December 12 through December 23, 2025 (all times U.S. ET): * December 12 at 19:00 - MongoDB Security Engineering detected the issue. * December 12-14 - We worked continuously to validate the issue and develop and test a fix. * December 15-17 - We developed and tested our rollout plans to enable rapid and safe deployment at scale, and commenced patching the Atlas fleet. * December 17 at 12:10 - We completed patching the majority of the Atlas fleet. * December 17 at 21:00 - Atlas provides an optional feature called "maintenance windows" that provides customers control over when MongoDB applies routine software updates to their Atlas instances. We proactively notified Atlas customers with maintenance windows configured that we would perform an urgent patch the following day, as part of our established policy. * December 18 - We patched the remainder of the Atlas fleet, including those with maintenance windows, and continued customer communications. * December 19 - We published the vulnerability through the industry-standard CVE process as CVE-2025-14847. * December 23 - We posted an update on MongoDB's community forum, sharing the patch and details on how to update. Protecting customers was our top priority throughout this process. Tens of thousands of MongoDB Atlas customers and hundreds of thousands of Atlas instances were proactively patched within days. Because MongoDB manages Atlas, we were able to deploy critical security patches quickly and safely on behalf of customers. In parallel with our Atlas remediation, we published patch versions of MongoDB for customers running MongoDB Enterprise Advanced. We also made available patched community builds and proactively notified Community Edition users through our community forum. Our goal was to ensure that all MongoDB users, whether running Atlas, Enterprise Advanced, or Community, had access to patches and clear guidance as quickly as possible. As with any operational event, this was another opportunity to learn, improve, and raise the bar. The software security space is rapidly evolving with new tools and techniques, and MongoDB will continue to evaluate and deploy new capabilities as part of our deep investment in security for our customers. Operating software and services securely at high scale is complex. Our responsibility is to continuously improve our products, act with urgency and transparency, and strengthen how we protect our customers. We appreciate the trust our customers place in MongoDB and remain committed to earning that trust every day. - Jim Scharf, Chief Technology Officer, MongoDB share this twitter iconlinkedin iconfacebook icon Author Jim Scharf, CTO - Photo Jim Scharf, CTO Chief Technology Officer MongoDB logo Language Selector Icon English * English * Portugues * Espanol * hangugeo * Ri Ben Yu * Italiano * Deutsch * Francais * Jian Ti Zhong Wen (c) 2025 MongoDB, Inc. About * Careers * Investor Relations * Legal * Privacy Policy * GitHub * Security Information * Trust Center * Follow Us Support * Contact Us * Customer Portal * Atlas Status * Product Updates * Customer Support * Manage Cookies * Your Privacy Choices Deployment Options * MongoDB Atlas * Enterprise Advanced * Community Edition Data Basics * Vector Databases * NoSQL Databases * Document Databases * RAG Database * ACID Transactions * MERN Stack * MEAN Stack (c) 2025 MongoDB, Inc.