CVE-2026-85963: CWE-918: Server-Side Request Forgery (SSRF) in Progress Software Corporation MarkLogic Server
Description
Progress Software Corporation's MarkLogic Server versions 11.x before 11.3.7 and 12.x before 12.1.0 contain a Server-Side Request Forgery (SSRF) vulnerability in deprecated OpsDirector functionality. This flaw allows an unauthenticated remote attacker to make unauthorized requests to internal services or forge trusted requests, potentially leading to unauthorized access to protected information. The vulnerability has a high severity with a CVSS score of 7.5.
CVSS v3.1
Score 7.5high
Affected software
Progress Software Corporation
MarkLogic Server
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-85963 is a Server-Side Request Forgery (SSRF) vulnerability affecting Progress MarkLogic Server 11.x versions prior to 11.3.7 and 12.x versions prior to 12.1.0. The issue arises from deprecated OpsDirector functionality that contains weaknesses enabling unauthenticated remote attackers to perform unauthorized requests to internal services or forge trusted requests. This can result in unauthorized access to protected information within the affected environment.
Potential Impact
An unauthenticated remote attacker can exploit this SSRF vulnerability to send unauthorized requests to internal services or forge trusted requests. This may lead to unauthorized access to protected information, compromising confidentiality. There is no indication of impact on integrity or availability. No known exploits are reported in the wild at this time.
Mitigation Recommendations
A fix is available in MarkLogic Server versions 11.3.7 and later, and 12.1.0 and later. Users should upgrade to these versions to remediate the vulnerability. Since this is not a cloud service, remediation requires applying the official patches or upgrades provided by Progress Software Corporation. Patch status is confirmed by the affectedVersions data indicating fixed versions.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- ProgressSoftware
- Date Reserved
- 2026-09-04T18:43:01.396Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6acd0f8e2cdf04f656b2d7c2
Added to database: 10/12/2026, 16:49:18 UTC
Last enriched: 10/12/2026, 17:03:45 UTC
Last updated: 10/13/2026, 03:48:07 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.