CVE-2025-11575: MongoDB Atlas ODBC Privilege Escalation

CVE-2025-11575 Overview

CVE-2025-11575 is an Incorrect Default Permissions vulnerability [CWE-276] affecting the MongoDB Atlas SQL ODBC driver on Windows. The flaw allows a local, authenticated user to escalate privileges on affected systems. It impacts MongoDB Atlas SQL ODBC driver versions 1.0.0 through 2.0.0.

The weakness stems from insecure default file or directory permissions applied during installation of the driver. A low-privileged local user can leverage those permissions to modify driver components and gain elevated privileges when the driver executes under a higher-privileged context.

Critical Impact
A local authenticated attacker can escalate to higher privileges on Windows hosts running vulnerable MongoDB Atlas SQL ODBC driver versions, compromising confidentiality, integrity, and availability of the affected system.

Affected Products

MongoDB Atlas SQL ODBC driver 1.0.0 on Windows
MongoDB Atlas SQL ODBC driver versions 1.0.0 through 2.0.0 on Windows
MongoDB Atlas SQL ODBC driver 2.0.0 on Windows

Discovery Timeline

2025-10-23 - CVE-2025-11575 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11575

Vulnerability Analysis

The MongoDB Atlas SQL ODBC driver installs files or directories on Windows with permissions that grant write access to non-privileged users. Because ODBC drivers can be loaded by services or applications running with elevated rights, an attacker who modifies driver files can influence code executed by a privileged process.

Exploitation requires local access and valid credentials on the target host. The attack does not require user interaction beyond the attacker's own actions. Successful exploitation results in privilege escalation, with impact extending across confidentiality, integrity, and availability of the endpoint and downstream data.

Root Cause

The root cause is classified under CWE-276: Incorrect Default Permissions. During installation, the driver sets Access Control Lists (ACLs) on installed artifacts that allow non-administrative users to modify or replace files that are later loaded by privileged processes. This violates the principle of least privilege on Windows file system objects.

Attack Vector

The attack vector is local. An authenticated user with standard privileges targets writable files or directories within the ODBC driver installation path. The attacker replaces or modifies a driver component, typically a DLL, so that a subsequent load by a privileged process executes attacker-controlled code. See the MongoDB Atlas Release Notes for version details and remediation guidance.

Because no verified proof-of-concept has been published, exploitation specifics are described in prose only. The typical pattern for CWE-276 on Windows involves identifying writable paths using tools such as icacls, dropping a malicious DLL, and waiting for or triggering a privileged process that loads the ODBC component.

Detection Methods for CVE-2025-11575

Indicators of Compromise

Unexpected modification timestamps on files within the MongoDB Atlas SQL ODBC driver installation directory
New or replaced DLLs in the driver install path that were not written by the vendor installer
ODBC driver components loaded by processes running as SYSTEM or a service account originating from user-writable paths
Windows Event Log entries showing image loads of unexpected binaries from the ODBC driver directory

Detection Strategies

Audit ACLs on the MongoDB Atlas SQL ODBC driver installation directory using icacls and flag any entries granting write access to Users, Authenticated Users, or Everyone
Monitor file integrity on driver binaries and configuration files to detect unauthorized modification
Correlate image-load telemetry with process privilege level to identify privileged processes loading DLLs from user-writable locations

Monitoring Recommendations

Enable Windows Sysmon Event ID 7 (Image Loaded) and Event ID 11 (File Created) for the ODBC driver install path
Alert on any write, rename, or replace operation targeting installed driver files by a non-administrative user
Track process-creation chains where an ODBC-consuming application spawns unexpected child processes such as cmd.exe or powershell.exe

How to Mitigate CVE-2025-11575

Immediate Actions Required

Inventory all Windows systems with the MongoDB Atlas SQL ODBC driver installed and identify versions between 1.0.0 and 2.0.0
Upgrade the driver to a fixed release as documented in the MongoDB Atlas Release Notes
Restrict interactive local logon on hosts that run the driver under privileged service accounts
Review and tighten ACLs on the driver installation directory to remove write access for non-administrative users

Patch Information

MongoDB has published remediation details in the MongoDB Atlas Release Notes. Administrators should upgrade beyond version 2.0.0 to a release that corrects the default installation permissions. Reinstalling on top of a compromised system without validating file integrity is not sufficient — verify that all driver files match vendor-provided hashes.

Workarounds

Manually reset directory and file ACLs on the driver install path so that only Administrators and SYSTEM retain write permissions
Remove the driver from hosts where it is not required until a fixed version is deployed
Enforce application allowlisting to prevent unauthorized DLLs from loading into privileged processes

bash

# Example: audit and harden ACLs on the ODBC driver install directory
icacls "C:\Program Files\MongoDB\Atlas SQL ODBC Driver"
icacls "C:\Program Files\MongoDB\Atlas SQL ODBC Driver" /remove:g "Users"
icacls "C:\Program Files\MongoDB\Atlas SQL ODBC Driver" /remove:g "Authenticated Users"
icacls "C:\Program Files\MongoDB\Atlas SQL ODBC Driver" /inheritance:r
icacls "C:\Program Files\MongoDB\Atlas SQL ODBC Driver" /grant:r "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F" "Users:(OI)(CI)RX"