Data
Serial number:AV25-866
Date:December 30, 2025
On October 9, 2025, SmarterTools published a security update to address a critical vulnerability in the following product:
Users and administrators of affected product versions are advised to update immediately to SmarterMail version Build 9413 or greater.
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary update.
Serial number:AV25-865
Date:December 29, 2025
Between December 22 and 28, 2025, Dell published security advisories to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number:AV25-864
Date:December 29, 2025
Between December 22 and 28, 2025, VMware published security advisories to address critical vulnerabilities in multiple Tanzu products:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number:AV25-863
Date:December 29, 2025
Between December 22 and 28, 2025, IBM published security advisories to address vulnerabilities in multiple products. Included were critical updates for the following:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Number: AL25-021
Date: December 29, 2025
This Alert is intended for IT professionals and managers.
An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested.
The Cyber Centre is aware of a high-severity vulnerability in MongoDB ServerFootnote1. In response to the vendor advisory released on December 19, 2025, the Cyber Centre issued AV25-862Footnote2 on December 24, 2025.
Tracked as CVE-2025-14847Footnote3, this vulnerability allows an unauthenticated remote attacker to read uninitialized heap memory due to mismatched length fields (CWE-130)Footnote4 in zlib-compressed protocol headers. The vulnerability occurs prior to authentication and affects multiple supported and legacy MongoDB versions.
The Cyber Centre has observed open-source reporting indicating that multiple Proofs of Concept (PoC) are available and that this vulnerability is being exploited in the wildFootnote5.
The Cyber Centre recommends that organizations upgrade affected MongoDB Server(s) to a fixed version:
| Affected product | Affected version | Fixed version |
|---|---|---|
| MongoDB 8.2 | 8.2.0 – 8.2.2 | 8.2.3 |
| MongoDB 8.0 | 8.0.0 – 8.0.16 | 8.0.17 |
| MongoDB 7.0 | 7.0.0 – 7.0.27 | 7.0.28 |
| MongoDB 6.0 | 6.0.0 – 6.0.26 | 6.0.27 |
| MongoDB 5.0 | 5.0.0 – 5.0.31 | 5.0.32 |
| MongoDB 4.4 | 4.4.0 – 4.4.29 | 4.4.30 |
| MongoDB 4.2 | All versions | No vendor fix; upgrade to fixed version |
| MongoDB 4.0 | All versions | No vendor fix; upgrade to fixed version |
| MongoDB 3.6 | All versions | No vendor fix; upgrade to fixed version |
If immediate patching is not possible, reduce exposure by:
As a precaution, it is recommended that organizations review their logs for potential signs of compromise including:
In addition, the Cyber Centre strongly recommends that organizations review and implement the Cyber Centre’s Top 10 IT Security Actions with an emphasis on the following topicsFootnote6.
Should activity matching the content of this alert be discovered, recipients are encouraged to report via My Cyber Portal, or email contact@cyber.gc.ca.
Serial number: AV25-862
Date: December 24, 2025
Updated: December 29, 2025
On December 15, 2025, MongoDB published a security advisory to address a vulnerability in the following products:
On December 29, 2025, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-14847 to their Known Exploited Vulnerabilities (KEV) Database.
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.