This vulnerability (CVE-2026-92756) in MongoDB Entity Framework Core Provider arises when applications combine independent encryption settings with the provider's own encryption settings. This combination can silently cause the loss of TLS and schema-map encryption settings, leading to sensitive fields being stored without encryption in the database. The flaw is classified under CWE-311 (Missing Encryption of Sensitive Data). It affects versions >=8.0.0 <8.4.3, >=9.0.0 <9.1.3, and >=10.0.0 <10.0.3. The CVSS 4.0 base score is 6.8, indicating a medium severity vulnerability with local attack vector, low complexity, and partial attack impact on confidentiality.

Sensitive data fields that are expected to be encrypted may be stored unencrypted in the database due to the loss of TLS and schema-map encryption settings. This exposure increases the risk of unauthorized data disclosure if the database is accessed by attackers or unauthorized users. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid combining independent encryption settings with the MongoDB Entity Framework Core Provider's encryption settings to prevent silent loss of encryption. Monitor vendor communications for updates on patches or official fixes.