CVE-2026-85961: CWE-532: Insertion of Sensitive Information into Log File in Progress Software Corporation MarkLogic Server

CVE-2026-85961 describes a vulnerability in Progress Software Corporation's MarkLogic Server where, on Azure deployments, versions 11.x prior to 11.3.7 and 12.x prior to 12.1.0 may record sensitive authentication data in diagnostic logs under specific configurations. This logging of sensitive information could be exploited by an attacker who gains access to these logs to obtain unauthorized access to cloud resources. The vulnerability is categorized under CWE-532 (Insertion of Sensitive Information into Log File). The CVSS 3.1 score is 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact. A patch is available, and the product is a cloud service where the vendor manages remediation.

An attacker with access to the affected diagnostic logs could retrieve sensitive authentication information, potentially leading to unauthorized access to protected cloud resources. The confidentiality impact is high, but integrity and availability are not affected. This could compromise the security of cloud deployments using the affected versions of MarkLogic Server on Azure.

A patch is available for this vulnerability. Users should upgrade MarkLogic Server to versions 11.3.7 or later for the 11.x branch, and 12.1.0 or later for the 12.x branch. Since this is a cloud service deployment on Azure, the vendor typically manages remediation server-side; users should verify with Progress Software that their environment has been updated accordingly. Check the vendor advisory for the latest remediation guidance.