CVE-2026-85949: CWE-532: Insertion of Sensitive Information into Log File in Progress Software Corporation MarkLogic Server

This vulnerability (CWE-532) involves the insertion of sensitive information into log files by Progress MarkLogic Server versions >=11.0.0 <11.3.7 and >=12.0.0 <12.1.0. The diagnostic logs may contain security-sensitive data under specific configurations, which could be exploited by an attacker with log access to compromise protected resources. The CVSS 3.1 base score is 8.1, reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, no confidentiality impact, but high integrity and availability impacts.

If exploited, an attacker with access to the affected diagnostic logs could obtain sensitive information that enables unauthorized access to protected resources, potentially leading to integrity and availability impacts on the system. There is no indication of confidentiality impact according to the CVSS vector. No known exploits are reported in the wild at this time.

No explicit patch links or vendor advisory content are provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is confirmed, restrict access to diagnostic logs to trusted personnel only and review logging configurations to minimize sensitive data exposure.