PHP object injection via unsuppressible __pclass class inference in command monitoring events
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-502.
Summary
Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to be honored when the driver builds monitoring event objects. When an application registers a command monitoring subscriber and includes untrusted data in a database operation, an unauthenticated party who controls that data may cause an application class implementing the driver's persistable interface to be instantiated and its unserialization method invoked with the supplied data. The resulting impact depends on the classes available in the application.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| MongoDB | PHP Driver | before 1.21.10; 2.0.0 to before 2.1.10; 2.2.0 to before 2.5.3 | 1.21.10, 2.1.10, 2.5.3 | Patch available | CNA |
- PHP Driver VendorMongoDB Affected before 1.21.10; 2.0.0 to before 2.1.10; 2.2.0 to before 2.5.3 Fixed in 1.21.10, 2.1.10, 2.5.3 Patch available CNA
Remediation
- Fix · CNA PHP Driver (MongoDB) Fixed in 1.21.10, 2.1.10, 2.5.3
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2026-96745
References
Other 5
- https://github.com/mongodb/mongo-php-driver/security/advisories/GHSA-cmvj-vxvq-rh2c
- https://github.com/mongodb/mongo-php-driver/releases/tag/1.21.10
- https://github.com/mongodb/mongo-php-driver/releases/tag/2.1.10
- https://github.com/mongodb/mongo-php-driver/releases/tag/2.5.3
- https://github.com/mongodb/mongo-php-driver/pull/2115
More MongoDB vulnerabilities
- TI-2019-08023 Code injection in mongo-express KEVCVSS 3.1CRITICAL 9.9
- TI-2025-13542 Zlib compressed protocol header length confusion may allow memory read KEVCVSS 4.0HIGH 8.7
- TI-2026-79432 BSON output corruption via out-of-range binary subtype in MongoDB C# Driver CVSS 4.0MEDIUM 6.9
- TI-2026-79424 NoSQL command injection via mismatched BSON length in MongoDB C# Driver CVSS 4.0MEDIUM 6.9
- TI-2026-79422 Unbounded memory growth in MongoDB C# Driver BSON deserialization CVSS 4.0HIGH 8.2
- TI-2026-79427 Authentication bypass via issuer-and-serial-only certificate equality CVSS 4.0HIGH 7.6
Sources
- CVE-2026-96745 · CVE Program
- CVE-2026-96745 · NVD
- FIRST EPSS
- CVE-2026-96745 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences