Is CVE-2026-96745 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-96745 being exploited in the wild.

How severe is CVE-2026-96745?

Medium severity, with a CVSS score of 5.6, published 24 September 2026.

Which products and versions are affected?

MongoDB PHP Driver versions prior to 1.21.10 and 2.5 (fixed).

Is there a fix for CVE-2026-96745?

A patch was published on 2026-09-24. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-96745 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-96745?

Check whether you run MongoDB PHP Driver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-96745: MongoDB PHP Driver deserialization of untrusted data in command monitoring

CVE-2026-96745 · Severity: medium · CVSS 5.6 · Published 2026-09-24

The MongoDB PHP Driver's command monitoring feature deserializes untrusted data from database operations without proper validation. An attacker who can control data in a database operation may cause arbitrary application classes to be instantiated and their unserialization methods invoked, potentially leading to remote code execution depending on what classes are available in the application.

Technologies: MongoDB PHP Driver. Vendors: MongoDB.

Quick answers

Is CVE-2026-96745 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-96745 being exploited in the wild.
How severe is CVE-2026-96745?: Medium severity, with a CVSS score of 5.6, published 24 September 2026.
Which products and versions are affected?: MongoDB PHP Driver versions prior to 1.21.10 and 2.5 (fixed).
Is there a fix for CVE-2026-96745?: A patch was published on 2026-09-24. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-96745 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-96745?: Check whether you run MongoDB PHP Driver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A deserialization vulnerability exists in the command monitoring support of the MongoDB PHP Driver where the __pclass inference for event object construction honors class names embedded in untrusted document content. When an application registers a command monitoring subscriber and processes attacker-controlled data, the driver may instantiate and unserialize arbitrary classes available in the application context. The vulnerability requires command monitoring to be explicitly enabled and affects versions prior to the patch.

Affected products

MongoDB PHP Driver versions prior to 1.21.10 and 2.5 (fixed)

Timeline

2026-09-24: disclosed
2026-09-24: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.