MongoDB Connector for BI CVE-2025-11535

Exploitation requires that MongoDB Connector for BI (versions 2.0.0 through 2.14.24) was installed via the Windows MSI installer to a CUSTOM (non-default) install directory, where the installer fails to set restrictive ACLs, leaving the directory writable by non-privileged users. The attacker must already be an authenticated low-privileged local user on the Windows host (PR:L, AV:L). Limiting factors: default install locations are reportedly not affected, so only custom-path installations are vulnerable; the flaw is Windows/MSI-specific and does not apply to other platforms; remote exploitation is not possible; and a privileged process or user must subsequently execute code from the weakly-permissioned directory for escalation to occur.

This is a genuine but conditional local privilege-escalation issue (CWE-276, Incorrect Default Permissions) rather than a broadly exploitable remote flaw. The only CVSS vector provided is CVSS 4.0 (AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, base 8.8): local attack vector, low complexity, but a Present attack requirement (AT:P) and Low privileges (PR:L) already required, meaning the attacker must be an authenticated local user and specific conditions (a custom install directory with unset ACLs) must hold. The high score is driven by full confidentiality/integrity/availability impact once escalation succeeds, not by ease of reach. Corroborating signals point to low real-world urgency: EPSS is only 0.12% (2nd percentile), there is no CISA KEV listing, and no public exploit code was identified. No SSVC decision data was supplied. The vendor's CVSS 4.0 marks subsequent-system impact as High (SC/SI/SA:H), which somewhat inflates the score for what is essentially single-host compromise; I independently assess subsequent-system impact as None. Net: a real but low-priority issue for most defenders - patch on normal cadence, prioritize only hosts where the Connector was installed to a non-default directory.

No public exploit code was identified. On a Windows host where MongoDB Connector for BI (2.0.0-2.14.24) was installed via MSI to a custom (non-default) directory, a low-privileged local user who already has access to the machine writes a malicious binary or DLL into the install directory, which inherits overly permissive ACLs. When a higher-privileged user or service later executes the Connector, the attacker's code runs with those elevated privileges. Because the attack vector is local (AV:L) with a present attack requirement, exploitation is confined to existing local users on affected installations.