Log in Start free

Vulnerability · Published Sep 24, 2026 · Assigned by mongodb

CVE-2026-96745PHP object injection via unsuppressible __pclass class inference in command monitoring events

Medium 5.6

In plain English

A medium-severity unsafe deserialization in PHP Driver from MongoDB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.6Medium
Exploit odds (30 days)0.3%top 74.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to be honored when the driver builds monitoring event objects. When an application registers a command monitoring subscriber and includes untrusted data in a database operation, an unauthenticated party who controls that data may cause an application class implementing the driver's persistable interface to be instantiated and its unserialization method invoked with the supplied data. The resulting impact depends on the classes available in the application.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12php-mongodbno fix listedDEBIAN-CVE-2026-96745
Debian:13php-mongodb2.0.0-1+deb13u1DEBIAN-CVE-2026-96745
Debian:14php-mongodb2.5.3-1DEBIAN-CVE-2026-96745
Ubuntu:22.04:LTSpymongono fix listedUBUNTU-CVE-2026-96745
Ubuntu:24.04:LTSpymongono fix listedUBUNTU-CVE-2026-96745
Ubuntu:26.04:LTSpymongono fix listedUBUNTU-CVE-2026-96745
Ubuntu:26.10pymongono fix listedUBUNTU-CVE-2026-96745

Affected products (as reported)

VendorProductVersions
MongoDB PHP Driver 0 – before 1.21.102.0.0 – before 2.1.102.2.0 – before 2.5.3

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

References