CVE-2026-92756

Published: Set 17, 2026 Last Modified: Set 18, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 6,8
Source: [email protected]
Attack Vector: local
Attack Complexity: low
Privileges Required: low
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM 5,5
Source: [email protected]
Attack Vector: local
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: none
Availability: none

Description

AI Translation Available

Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption settings may silently lose TLS and schema-map settings leading to protected fields being stored unencrypted in the database.

311

Missing Encryption of Sensitive Data

Draft
Abstraction: Class Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality Integrity
Potential Impacts:
Read Application Data Modify Application Data
Applicable Platforms
All platforms may be affected
Likelihood of Exploit: High
View CWE Details
https://jira.mongodb.org/browse/EF-388
https://jira.mongodb.org/browse/EF-388