Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 enable XML external entity processing by default in multiple… (CVE-2026-85970)

CVE-2026-85970 affects Progress MarkLogic Server 12.x releases prior to 12.1.0 and 11.x releases prior to 11.3.7. These versions enable XML external entity processing by default across multiple server components. This default setting can be exploited by an attacker supplying crafted XML to cause the server to make unintended requests or disclose local file contents. The vulnerability is classified under CWE-611 (Improper Restriction of XML External Entity Reference).

An attacker with the ability to supply XML input to affected MarkLogic Server versions could exploit this vulnerability to cause the server to perform unauthorized server-side requests or disclose local files. This can lead to information disclosure and partial denial of service. The CVSS score of 7.1 indicates a high severity impact with network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or vendor advisories are provided, users should monitor official Progress MarkLogic communications for updates. Until a fix is available, consider disabling XML external entity processing if configurable or restricting XML input sources to trusted entities.