PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-92757 MongoDB Inc. CVE debrief

CVE-2026-92757 debrief based on CVE Program and NVD records. Applications built on MongoDB Entity Framework Core Provider that place a database name in the connection string may inadvertently disable field level encryption. This could potentially expose sensitive data. Defenders and developers should assess usage and database connection strings to verify field level encryption configuration and prevent potential data exposure. The CVE record was published on 2026-09-17T20:18:57.293Z and has not been modified since then.

Vendor
MongoDB Inc.
Product
MongoDB Entity Framework Core Provider
CVSS
MEDIUM 6.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-17
Original CVE updated
2026-09-18
Advisory published
2026-09-17
Advisory updated
2026-09-18

Who should care

Defenders and developers using MongoDB Entity Framework Core Provider should assess potential exposure and verify field level encryption configuration.

Why it matters

CVE-2026-92757 requires verification of field level encryption configuration in MongoDB Entity Framework Core Provider to prevent potential data exposure. Defenders and developers should assess usage and database connection strings.

  • Verify field level encryption configuration to prevent potential data exposure.
  • Assess MongoDB Entity Framework Core Provider usage and database connection strings.
  • Review potential impact on sensitive data due to field level encryption disablement.

Technical summary

CVE-2026-92757 affects applications built on MongoDB Entity Framework Core Provider that place a database name in the connection string, potentially disabling field level encryption. This could lead to unintended data exposure if field level encryption is not properly configured. The vulnerability requires verification of field level encryption configuration to prevent potential data exposure. Defenders and developers should assess MongoDB Entity Framework Core Provider usage and database connection strings.

Defensive priority

Assess MongoDB Entity Framework Core Provider usage and verify field level encryption configuration.

Recommended defensive actions

  • Review MongoDB Entity Framework Core Provider connection strings for database names.
  • Verify field level encryption configuration for applications using MongoDB Entity Framework Core Provider.
  • Assess potential impact of field level encryption disablement on sensitive data.

Evidence notes

CVE Program and NVD records indicate potential field level encryption disablement in MongoDB Entity Framework Core Provider. Official records do not provide specific exploitation details.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-92757 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-92757

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-92757 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-92757

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.