What it is
Ports where databases (MySQL, PostgreSQL, MongoDB, Oracle …) accept direct connections.
Why it is risky
A DB port open to the internet invites credential brute-force and known-CVE exploitation that can exfiltrate an entire dataset — the shortest path to a breach or ransom.
What to do
Allow access only from app servers / internal networks (private ranges or VPN); close it on public interfaces.
Is it listening on your server?
Linux
ss -ltnp 'sport = :27017'Known vulnerabilities in MongoDB
| CVE | Title | CVSS | Exploited | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2025-14847 | Zlib compressed protocol header length confusion may allow memory read | 8.7 | KEV | 83.2% | 2025-12-19 |
| CVE-2026-118383 | Pre-authentication use-after-free in MongoDB Server replica set primary catch-up | 9.5 | 0.7% | 2026-11-11 |
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.