CVE-2026-85970: CWE-611: Improper Restriction of XML External Entity Reference in Progress Software Corporation MarkLogic Server

Progress MarkLogic Server versions 11.x before 11.3.7 and 12.x before 12.1.0 have XML external entity processing enabled by default in multiple server components. This improper restriction (CWE-611) allows attackers to supply crafted XML that can cause the server to perform unintended requests or disclose local file contents. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact.

Successful exploitation could lead to disclosure of sensitive local files on the server or cause the server to make unintended network requests, potentially exposing internal resources or sensitive information. The confidentiality impact is high, while integrity is unaffected and availability impact is low.

A fix is available in MarkLogic Server versions 11.3.7 and later, and 12.1.0 and later. Users should upgrade to these versions to remediate the vulnerability. No vendor advisory content was provided to indicate alternative mitigations or temporary workarounds. Patch status is confirmed by the affected version ranges indicating fixed versions.