Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain privileged legacy InfoStudio modules that do not… (CVE-2026-85953)

CVE-2026-85953 affects Progress MarkLogic Server 12.x releases prior to 12.1.0 and 11.x releases prior to 11.3.7. The vulnerability arises from privileged legacy InfoStudio modules that do not adequately validate user-controlled file paths and user-context values. This insufficient validation can be exploited to gain unauthorized access to server files or to execute operations under an unintended identity, potentially compromising confidentiality and integrity of the system. The CVSS v3.1 base score is 8.5, reflecting network attack vector, low attack complexity, required privileges, no user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact.

Exploitation of this vulnerability could lead to unauthorized disclosure of sensitive server files and partial integrity compromise by executing actions under an unintended identity. The vulnerability does not impact availability. The high CVSS score indicates a significant risk to confidentiality and some risk to integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or vendor advisory content were provided, it is recommended to monitor official Progress MarkLogic advisories for updates and apply any official fixes once available. Until then, restrict access to the affected modules and monitor for suspicious activity related to InfoStudio modules.