Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authentication validation weakness that could allow… (CVE-2026-85958)

CVE-2026-85958 describes an authentication validation weakness in Progress MarkLogic Server 12.x releases prior to 12.1.0 and 11.x releases prior to 11.3.7. The vulnerability allows an attacker to use an invalid token that the server incorrectly accepts, which could result in unauthorized access. The CVSS 3.1 base score is 7.5, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

An attacker exploiting this vulnerability could gain unauthorized access to the affected MarkLogic Server by bypassing authentication token validation. This compromises the integrity of the system by allowing unauthorized actions. There is no reported impact on confidentiality or availability.

The input data does not provide explicit patch or remediation information. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is applied, restrict access to the affected servers and monitor for suspicious authentication attempts related to token misuse.