CVE-2025-11535CWE-276

CVE-2025-11535

published October 9, 2025

CVSS

8.8

EPSS

Percentile

1.8

In the wild

Unconfirmed

What it is

MongoDB Connector for BI installation via MSI on Windows leaves ACLs unset on custom install directories allows Privilege Escalation.This issue affects MongoDB Connector for BI: from 2.0.0 through 2.14.24.

The record

Technical detail

CVSS: 8.8 · NONE
CVSS v4.0: Not supplied
EPSS: 0.00122 · 1.8th percentile
Weakness: CWE-276 · Incorrect Default Permissions
Published: 2025-10-09T02:15Z

References (1)

https://www.mongodb.com/docs/bi-connector/current/release-notes/#bi-2.14.25 · [email protected]

EPSS history

Timeline

08 OCT 22:07Z
MongoDB Connector for BI installation MSI leave ACLs unset on custom installation directories
cvelistv5