CVE-2026-96745

Name of the Vulnerable Software and Affected Versions MongoDB PHP Driver (affected versions not specified)

Description Deserialization of untrusted data in the command monitoring support allows class names embedded in document content to be honored during the construction of monitoring event objects. If an application registers a command monitoring subscriber and processes untrusted data in a database operation, an unauthenticated party controlling that data can trigger the instantiation of an application class that implements the driver's persistable interface. This process invokes the class's unserialization method using the supplied data, with the final impact depending on the specific classes available within the application.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.