How severe is CVE-2026-25612?

CVE-2026-25612 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2026-25612 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (10th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-25612?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-25612 have an EU (EUVD) identifier?

Yes. CVE-2026-25612 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-6765.

When was CVE-2026-25612 published?

CVE-2026-25612 was published on 2026-02-10 and last updated on 2026-06-17.

CVE-2026-25612

CVE-2026-25612 is a medium-severity vulnerability with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-412.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
CVSS v4: 7.1
EPSS exploit prediction: 0% (10th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-6765
Weakness: CWE-412
Published: 2026-02-10
Last modified: 2026-06-17

Description

The internal locking mechanism of the MongoDB server uses an internal encoding of the resources in order to choose what lock to take. Collections may inadvertently collide with one another in this representation causing unavailability between them due to conflicting locks.

Frequently asked questions

What is CVE-2026-25612?: The internal locking mechanism of the MongoDB server uses an internal encoding of the resources in order to choose what lock to take. Collections may inadvertently collide with one another in this representation causing unavailability between them due to conflicting locks.
How severe is CVE-2026-25612?: CVE-2026-25612 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2026-25612 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (10th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-25612?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-25612 have an EU (EUVD) identifier?: Yes. CVE-2026-25612 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-6765.
When was CVE-2026-25612 published?: CVE-2026-25612 was published on 2026-02-10 and last updated on 2026-06-17.

References

Other CWE-412 vulnerabilities

CVE-2019-18269 — Critical (CVSS 9.8): Omron’s CS and CJ series PLCs have an unrestricted externally accessible lock vulnerability.
CVE-2019-11485 — Low (CVSS 3.3): Sander Bos discovered Apport's lock file was in a world-writable directory which allowed all users to prevent crash…

Browse all CWE-412 vulnerabilities →