BaseFortify

Publication date: 2026-09-17

Last updated on: 2026-09-24

Assigner: MongoDB, Inc.

Description

Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption settings may silently lose TLS and schema-map settings leading to protected fields being stored unencrypted in the database.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-17

Last Modified

2026-09-24

Generated

2026-10-10

EPSS Evaluated

2026-10-09

NVD

CVE-2026-92756

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	entity_framework_core_provider	From 10.0.0 (inc) to 10.0.3 (exc)
mongodb	entity_framework_core_provider	From 8.0.0 (inc) to 8.4.3 (exc)
mongodb	entity_framework_core_provider	From 9.0.0 (inc) to 9.1.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-311	The product does not encrypt sensitive or critical information before storage or transmission.

Attack-Flow Graph

AI Quick Actions have not been generated yet.

Hi! I’m here to help you understand CVE-2026-92756. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70