Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an improper authentication vulnerability in SAML… (CVE-2026-85962)

CVE-2026-85962 describes an improper authentication vulnerability in the SAML processing component of Progress MarkLogic Server. Affected versions include 12.x releases prior to 12.1.0 and 11.x releases prior to 11.3.7. The vulnerability allows an unauthenticated remote attacker to bypass normal authentication checks by causing the server to accept a malicious SAML assertion that should have been rejected. This could result in unauthorized access to the affected server. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

An unauthenticated remote attacker can exploit this vulnerability to gain unauthorized access by bypassing SAML authentication controls. This compromises the integrity of the authentication process, potentially allowing the attacker to perform actions with elevated privileges or access sensitive resources without proper authorization. There is no direct confidentiality or availability impact reported.

The vulnerability affects Progress MarkLogic Server 12.x versions before 12.1.0 and 11.x versions before 11.3.7. Applying the official fixes in versions 12.1.0 or later and 11.3.7 or later will remediate this issue. Since no vendor advisory content or patch links are provided in the input, users should consult the official Progress MarkLogic security advisories for confirmation and to obtain the appropriate patches. Until patched, avoid deploying vulnerable versions in environments where SAML authentication is used or implement compensating controls if possible.