CVE-2025-14847 MongoBleed MongoDB Memory Leak Vulnerability Exploited in the Wild
High
Executive Summary
The MongoBleed vulnerability, CVE-2025-14847, is a memory leak in MongoDB that allows unauthenticated attackers to remotely extract sensitive information, and is being actively exploited in the wild. Exploit code is publicly available, making exploitation easier.
Vulnerability Details
Affected Product: MongoDB Server versions 3.6.x, 4.0.x, 4.2.x, 4.4.x prior to 4.4.30, 5.0.x prior to 5.0.32, 6.0.x prior to 6.0.27, 7.0.x prior to 7.0.28, 8.0.x prior to 8.0.17, and 8.2.x prior to 8.2.3
Identifier: CVE-2025-14847
CVSS Score: 8.7 (High)
Exploitation Status: Actively Exploited
Risk & Impact
Triage: Immediate patching is critical due to active exploitation and the ease of exploitation. CISA urges users to patch before January 19, 2026.
Attack Vector: An unauthenticated, remote attacker can send specially crafted compressed packets to trigger the vulnerability. This causes the server to miscalculate decompressed message lengths and disclose uninitialized heap memory.
Ease of Exploit: Public proof-of-concept exploit code is available, requiring only the IP address of the affected MongoDB instance to retrieve sensitive data. The attack does not require authentication.
Action Plan
Immediate Action: Upgrade to MongoDB versions 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, or 4.4.30. Critical Warning: MongoDB versions 3.6, 4.0, and 4.2 are End-of-Life (EOL) and will not receive a patch. Organizations on these versions must immediately disable zlib compression (see Workaround) or migrate to a supported version to prevent data exfiltration.
Workaround: If patching is not immediately possible, disable zlib compression on the MongoDB Server. This can be done by starting `mongod` or `mongos` with a `networkMessageCompressors` or a `net.compression.compressors` option that explicitly omits zlib. Safe values include `snappy`, `zstd`, or `disabled`. Restrict network access to trusted IPs only.
Detection: Enable verbose JSON logging to track connection metadata and parsing errors. Scan logs for bursty connections with missing metadata from suspicious IPs. Look for high connection volume from a single source IP address, missing client metadata, and short-term peak activity of over 100,000 connections per minute.
Relevant professional terms
Memory Leak
A memory leak is an unintentional form of memory consumption whereby a program fails to release memory that it no longer needs, leading to decreased performance, system instability, or crashes.
Heap Memory
Heap memory is the memory that programs use for dynamic allocation during runtime. Unlike stack memory, heap memory is not managed automatically.
CVE-2023-52970: MariaDB Server Crash Vulnerability
Medium
Executive Summary
CVE-2023-52970 describes a vulnerability in MariaDB Server versions 10.4 through 11.4 that can lead to a denial-of-service (DoS) condition due to a crash in the Item_direct_view_ref::derived_field_transformer_for_where function. The vulnerability is currently awaiting analysis.
Vulnerability Details
Affected Product: MariaDB Server versions 10.4 through 10.5, 10.6 through 10.6, 10.7 through 10.11, 11.0 through 11.0, and 11.1 through 11.4
Identifier: CVE-2023-52970
CVSS Score: 4.9 (Medium)
Exploitation Status: Not Actively Exploited
Risk & Impact
Triage: Immediate action is recommended to mitigate potential denial-of-service attacks.
Attack Vector: A remote, privileged user can crash the server by sending a specially crafted query.
Ease of Exploit: Requires a privileged user to send a crafted query.
Action Plan
Immediate Action: Official vendor patches are available. Upgrade immediately to MariaDB versions 10.5.28, 10.6.17, 10.11.7, or newer.
Detection: Utilize vulnerability scanners like Nessus and Qualys for detection.
Relevant professional terms
Denial of Service (DoS)
An attack that attempts to make a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a host connected to a network.
CVSS (Common Vulnerability Scoring System)
A standardized scoring system for rating the severity of security vulnerabilities.
Marquis Software Ransomware Attack on Financial Institutions
Executive Summary
Marquis Software Solutions, a fintech company, suffered a ransomware attack impacting over 400,000 customers across 74 U.S. financial institutions. The attackers exploited a vulnerability in Marquis's SonicWall firewall to access sensitive customer data.
Attack Overview
Attack Path: The attackers gained initial access by exploiting a vulnerability in Marquis's SonicWall firewall. Security researchers have linked the attack to CVE-2024-40766.
Attacker: The Akira ransomware group is suspected to be behind the attack.
Impact Assessment
Data Stolen: The breach exposed names, addresses, Social Security numbers, Taxpayer Identification Numbers, and financial account information.
Detection & Hunting
IOCs: Geo-IP filtering and botnet IP blocking.
Detection Guidance: Implement MFA, account lockouts, and patch SonicWall firewalls.
Strategic Takeaway
This incident highlights the significant supply chain risk posed by third-party vendors in the financial sector.
Relevant professional terms
Ransomware
A type of malware that encrypts a victim's data and demands a ransom payment to restore access.
Zero-day Vulnerability
A software vulnerability that is unknown to the vendor and for which no patch is available.
The Mustang Panda APT group is delivering the ToneShell backdoor via a kernel-mode rootkit in attacks against government organizations. The rootkit helps conceal the malware's activity from security tools.
Key TTPs
Initial Access: Compromised websites and phishing emails.
Execution: DLL side-loading.
Defense Evasion: Kernel-mode rootkit to conceal activity.
Campaign Analysis
The campaign deploys a Kernel-Mode Rootkit using a malicious driver named ProjectConfiguration[.]sys. This driver is digitally signed by the compromised certificate of "Guangzhou Kingteller Technology Co., Ltd", allowing it to bypass Windows Driver Signature Enforcement (DSE) and hide the ToneShell backdoor from EDR agents.
Targeting & Infrastructure
Target Profile: Government organizations in Southeast and East Asia, including Myanmar and Thailand.
Infrastructure: Command-and-control servers using FakeTLS to mimic legitimate TLS traffic.
Actionable Intelligence
IPs:146.70.29[.]229
Domains: Hong Kong based C2 server
Relevant Terms
Rootkit: A type of malware designed to hide the existence of certain processes or programs from normal methods of detection and enable continued privileged access to a computer.
DLL Side-Loading: An attack technique where a malicious Dynamic Link Library (DLL) file is placed in the same directory as a legitimate application to be loaded instead of the intended DLL.
The Silver Fox threat actor is targeting Indian users with income tax-themed phishing emails to distribute the ValleyRAT (aka Winos 4.0) remote access trojan. This campaign uses a complex kill chain involving DLL hijacking to ensure persistence.
Key TTPs
Initial Access: Phishing emails with income tax-themed lures.
Execution: DLL hijacking.
Defense Evasion: Modifying antivirus exclusion paths and binary proxy execution.
Campaign Analysis
Silver Fox, known for espionage and financial gain, is expanding its targeting from primarily Chinese-speaking users to include organizations in various sectors. The group uses a multi-pronged approach, including SEO poisoning and phishing, to deliver ValleyRAT variants.
Targeting & Infrastructure
Target Profile: Indian users, organizations operating in the public, financial, medical, and technology sectors.
Infrastructure: Fake software sites and Alibaba Cloud URLs.
Scammers are increasingly using AI to generate images of damaged goods, enabling them to fraudulently claim refunds from retailers. This trend is creating challenges for e-commerce platforms and impacting trust in online shopping.
Key Findings
AI-doctored refund images have risen more than 15% globally since early 2025.
Retailers are receiving AI-manipulated claims, with some detecting manipulations through inconsistencies like misaligned letters on garment labels.
Organized crime groups are exploiting this technique, with one case involving over $1 million in fake claims for home goods.
The Bottom Line
The rise of AI-driven refund fraud poses a significant threat to e-commerce businesses, eroding trust and potentially increasing costs for both retailers and consumers. Platforms and retailers need to invest in advanced detection systems and fraud-resistant workflows to combat these evolving threats. Balancing customer-friendly policies with robust fraud prevention measures is crucial to maintaining a secure and trustworthy online shopping environment.
Relevant Terms
Generative AI: A type of artificial intelligence that can create new content, such as images, text, and audio.
Refund Fraud: Illegitimately obtaining a refund for a purchase, often through deceptive means.
Critical Intelligence: React2Shell Mass Exploitation
Executive Summary
Wiz Research reports that 50% of customer environments with exposed React/Next.js assets are already showing signs of compromise via the React2Shell (CVE-2025-55182) vulnerability. This unauthenticated Remote Code Execution (RCE) flaw allows attackers to compromise servers via a single HTTP request using improper deserialization.
Operational Insight
Obsolescence of Standard Patching: The speed of exploitation for React2Shell has rendered traditional, scheduled patch cycles obsolete.
High-Fidelity Alerting: Wiz has deployed "Validated External Risk Issues" (SOC-level alerts) to actively distinguish between theoretical vulnerabilities on disk and those that are actively exposed to the internet.
Actionable Takeaway
Immediate Verification: Security teams cannot rely on scheduled scans; organizations must immediately verify if their React applications are facing the public internet.
