CVE-2026-96745
Awaiting Analysis Awaiting Analysis - Queue

Deserialization of Untrusted Data in MongoDB PHP Driver

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: MongoDB, Inc.

Description
Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to be honored when the driver builds monitoring event objects. When an application registers a command monitoring subscriber and includes untrusted data in a database operation, an unauthenticated party who controls that data may cause an application class implementing the driver's persistable interface to be instantiated and its unserialization method invoked with the supplied data. The resulting impact depends on the classes available in the application.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-25
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-96745
EUVD
EUVD-2026-86264

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
mongodb mongo_php_driver 2.1.10
mongodb mongo_php_driver 2.5.3
mongodb mongo_php_driver 1.21.10
mongodb php_driver *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves deserialization of untrusted data in the MongoDB PHP Driver's command monitoring support. When untrusted data is included in a database operation by an application with a registered command monitoring subscriber, an attacker can cause a class implementing the driver's persistable interface to be instantiated and its unserialization method invoked with the supplied data. This can lead to arbitrary code execution depending on available classes in the application.

Detection Guidance

This vulnerability involves deserialization of untrusted data in the MongoDB PHP Driver's command monitoring. To detect it, inspect PHP applications using the MongoDB PHP driver for command monitoring subscribers that process untrusted data. Check for unusual class instantiations or unserialization events in logs. No specific commands are provided in the context, but monitoring for unexpected class loading or deserialization in PHP logs may help.

Impact Analysis

The impact depends on the classes available in your application. An attacker could exploit this to execute arbitrary code, potentially leading to data breaches, system compromise, or unauthorized access to sensitive information. The vulnerability requires an application to register a command monitoring subscriber and include untrusted data in operations.

Compliance Impact

This vulnerability could lead to unauthorized data access or exposure, violating GDPR's data protection principles or HIPAA's security requirements. Organizations may face compliance violations, fines, or legal consequences if exploited, especially if sensitive personal or health data is compromised.

Mitigation Strategies

Update the MongoDB PHP Driver to the latest version that patches this deserialization vulnerability. Review applications using the driver to ensure untrusted data is properly sanitized before inclusion in database operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-96745. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart