CVE-2026-92757: Malformed connection string may disable field level encryption

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-17 · updated 2026-09-24
Weakness: CWE-311

Description

Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption.

Affected products

MongoDB Inc. MongoDB Entity Framework Core Provider: from 8.0.0 before 8.4.4; from 9.0.0 before 9.1.4; from 10.0.0 before 10.0.4 — fixed in 10.0.4, 8.4.4, 9.1.4

How to fix

Upgrade to a fixed version: MongoDB Inc. MongoDB Entity Framework Core Provider 10.0.4, 8.4.4, 9.1.4. Check the vendor advisory for mitigations.

References

https://jira.mongodb.org/browse/EF-389

Get alerted when CVE-2026-92757 or the next vulnerability affects your stack