{"id":"CVE-2025-11535","title":"MongoDB Connector for BI installation via MSI on Windows leaves ACLs unset on custom install directories allows Privilege Escalation.This issue affects MongoDB Connector for BI: from 2.0.0 through 2.14.24.","summary":"MongoDB Connector for BI installation via MSI on Windows leaves ACLs unset on custom install directories allows Privilege Escalation.This issue affects MongoDB Connector for BI: from 2.0.0 through 2.14.24.","severity":"none","cwe":["CWE-276"],"published":"2025-10-08","updated":"2026-10-08","sourceUpdated":"2026-10-08T13:10:00.200","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-11535","references":[{"url":"https://www.mongodb.com/docs/bi-connector/current/release-notes/#bi-2.14.25","label":"cna@mongodb.com"}],"tags":["nvd"],"epss":0.00122,"epssPercentile":0.01744,"ingestedAt":"2026-10-08T13:42:55.017Z","slug":"CVE-2025-11535","body":"## Overview\n\nMongoDB Connector for BI installation via MSI on Windows leaves ACLs unset on custom install directories allows Privilege Escalation.This issue affects MongoDB Connector for BI: from 2.0.0 through 2.14.24.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}