EUVD-2026-86264Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Untrusted data source is unauthenticated (PR:N) but exploitation needs an opt-in monitoring subscriber plus a usable gadget class, so AC:H; base impacts Low and gadget-dependent.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
Lifecycle Timeline
2DescriptionCVE.org
Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to be honored when the driver builds monitoring event objects. When an application registers a command monitoring subscriber and includes untrusted data in a database operation, an unauthenticated party who controls that data may cause an application class implementing the driver's persistable interface to be instantiated and its unserialization method invoked with the supplied data. The resulting impact depends on the classes available in the application.
AnalysisAI
Deserialization of untrusted document content in the MongoDB PHP Driver (CWE-502) lets class names embedded in a field such as __pclass be honored when the driver constructs command-monitoring event objects, so an unauthenticated party who controls data flowing into a database operation can cause an application class implementing the driver's persistable interface to be instantiated and have its unserialization method invoked. The flaw only bites applications that (1) register a command monitoring subscriber and (2) pass attacker-controlled data into an operation reflected in monitoring events; impact ranges from benign to severe depending on which gadget classes exist in the deployment, which is why the vendor rates it 6.3 (CVSS 4.0, AV:N/AC:H/PR:N/UI:N/VC:L/VI:L/VA:L) and our independent assessment lands at CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the PHP application (1) registers a command monitoring subscriber via the MongoDB driver, and (2) passes attacker-controlled/untrusted data into a database operation whose document content is reflected in monitoring events. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but conditional deserialization flaw (CWE-502) in the MongoDB PHP Driver, rated CVSS 4.0 6.3 (medium) by the reporting vendor (MongoDB) with vector AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the PECL mongodb extension to a vendor-released fixed version, choosing the line that matches your PHP compatibility: 1.21.10, 2.1.10 or 2.5.3 (https://github.com/mongodb/mongo-php-driver/releases/tag/1.21.10, https://github.com/mongodb/mongo-php-driver/releases/tag/2.1.10, https://github.com/mongodb/mongo-php-driver/releases/tag/2.5.3); installation examples include `pie install mongodb/mongodb-extension:2.5.3` or the equivalent PECL package. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today