MONGODB vulnerability in ZLIB

[verbal_666]

Hello.
Recently a critical vulnerability was found in ZLIB of MongoDB.

https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/vulnerability-in-mongodb-pr...

Is there a way resolve this internal issue?

Thanks.

[verbal_666 · Accepted solution]

https://advisory.splunk.com/advisories/SVD-2026-0101

[verbal_666]

Can someone, please, open a case to SPLUNK for official communication?
I get error after sending a NEW CASE

MONGODB Vulnerability CVE-2025-14847

https://www.mongodb.com/company/blog/news/mongodb-server-security-update-december-2025

SPLUNK ENTERPRISE
9.3.X
9.4.X
10.X.X

/opt/splunk/bin/splunk cmd mongod -version

SECURITY ISSUE

[PickleRick]

If you have an active entitlement and raising support cases gives you error, call your local Splunk sales contact to escalate the issue.

[livehybrid]

Hi @verbal_666 

Keep an eye on https://advisory.splunk.com/ for any updates regarding this Vuln which will contain details around if/how mitigations should be applied to Splunk. 

We are also due a maintenance update to 9.4.x imminently (10.2 was released last week).

Its also worth raising a support case with Splunk directly to discuss this as they may be able to provide additional information under your contract/NDA with them.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[verbal_666]

👍👍👍

[PickleRick]

It will probably be patched in some subsequent release. But the standard disclaimer for all alarm bell ringers applies - verify the scope and exposition surface of your "vulnerabilities". Even if there is an issue with mongodb, normally you shouldn't provide remote access (or even a local one - you don't normally allow users shell access to your Splunk components).

So don't just blindly rush to patch everything just because Nessus or Nexpose flagged something red.

[verbal_666]

I know it, only SPLUNK instance can access mongodb from localhost only and our SPLUNK it's not exposed outside, only in Intranet.

But my Company wants a solution or a valid explanation to exclude vulnerabilities on the instances 😥

Maybe a formal official SPLUNK communication could help! 😎

Thanks 👍👍👍

[PickleRick]

Yes. That's why good vulnerability management process includes actual risk management, not just pure CVSS or whatever magical number the scanner comes up with. The proper behaviour here - for me - would be to create an exception with an explanation of the vulnerability characteristics and "applicability"