This vulnerability (CVE-2026-7557) in Progress MarkLogic Server arises from improper verification of cryptographic signatures in the SAML authentication module. It allows an unauthenticated remote attacker to bypass authentication controls and impersonate any user, including administrative accounts, on affected deployments where SAML single sign-on is enabled. The affected versions explicitly identified are 11.0.0 and 12.0.0. The CVSS v3.1 base score is 9.1, indicating a critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality and integrity. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

An attacker can remotely bypass authentication without any privileges or user interaction, gaining unauthorized access to the system as any user, including administrators. This can lead to full compromise of the affected MarkLogic Server instances with SAML single sign-on enabled, severely impacting confidentiality and integrity of data. Availability is not impacted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider disabling SAML single sign-on if feasible or implementing compensating controls to restrict access. Monitor vendor communications closely for updates.