CVE-2025-10491

HIGH

MongoDB Windows installation MSI may leave ACLs unset on custom installation directories

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-10491 has a selected CVSS score of 7.8 (high).

Description

The MongoDB Windows installation MSI may leave ACLs unset on custom installation directories allowing a local attacker to introduce executable code to MongoDB's process via DLL hijacking. This issue affects MongoDB Server v6.0 version prior to 6.0.25, MongoDB Server v7.0 version prior to 7.0.21 and MongoDB Server v8.0 version prior to 8.0.5

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 16, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

MongoDB Server

Browse MongoDB Inc / MongoDB Server

Default status: unaffected

CVE List6.0 to < 6.0.25affected
7.0 to < 7.0.21affected
8.0 to < 8.0.5affected

References

2