MongoDB EF Core EUVD-2026-116267

Exploitation requires an application using the MongoDB Entity Framework Core provider to place caller-supplied values into a bulk update that is expressed as a database expression, where those values are not neutralized before being sent to the database - this is the exact feature/usage pattern that must be present. The attacker must be authenticated with at least low privilege (PR:L), and the 4.0 vector's AT:P indicates an additional attack requirement must hold; the specific trigger condition behind AT:P is not described in the available sources. Limiting factors: the application must actually route untrusted input into such a bulk-update expression (not merely use the provider), the attacker needs valid low-privilege credentials, and impact is confined to fields within the records the application is already updating (Low confidentiality and integrity, no availability impact).

All signals converge on low real-world priority. The supplied CVSS 4.0 base score is 2.3 (Low) with vector AV:N/AC:L/AT:P/PR:L/UI:N and only Low confidentiality and integrity impact (VC:L/VI:L) and no availability impact (VA:N); the AT:P metric indicates a specific attack requirement must be met, and PR:L means the attacker must already be authenticated at low privilege. The vuln.today decision label is 'monitor', the weakest urgency tier, which is consistent with the low score. No EPSS probability, no CISA KEV listing, and no confirmed proof-of-concept were provided - the single reference is a MongoDB Jira ticket (EF-478), i.e. a vendor tracking record, not exploit code. The only mild tension is that the tags include 'Information Disclosure' while the description emphasizes integrity effects (fields being modified and data relocated within a record) rather than disclosure; the 4.0 vector does carry VC:L, so some limited confidentiality impact is asserted, but the described mechanism is primarily an integrity problem. Net: this is a genuinely low-severity, low-urgency issue, not a high-CVSS-but-overhyped case nor an under-rated one.

A low-privileged authenticated user of an application built on the MongoDB Entity Framework Core provider submits ordinary input through a normal field that the application feeds into a bulk update expression. Because special elements are not neutralized, the value is interpreted as database expression syntax rather than plain data, causing unintended fields in the records being updated to be modified or existing field data to be relocated into other fields of the same record. No public exploit identified at time of analysis; the only reference is a MongoDB Jira ticket, not working exploit code.