1.87 Million MongoDB Services Exposed Online, but Most May Not Be Vulnerable

A ZoomEye scan conducted on September 16, 2026, detected nearly 1.87 million internet-reachable services running the MongoDB protocol, a figure that has been widely misread as evidence of a mass data breach. Experts caution that a service fingerprint only confirms network reachability, not whether authentication is disabled or sensitive data is present. MongoDB's troubled security history dates to 2017, when older versions shipped with no authentication by default, leading to large-scale data-loss incidents; current versions require explicit misconfiguration to be exposed without credentials. The actual risk of any individual instance depends on three factors: whether authentication is enabled, how sensitive the stored data is, and the network's broader architecture. Security teams are advised to test connections from outside trusted networks and avoid treating a reachability count as a direct measure of vulnerability or compromise.