Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 include deprecated OpsDirector functionality with weaknesses… (CVE-2026-85963)
Description
Progress MarkLogic Server versions 12.x before 12.1.0 and 11.x before 11.3.7 contain deprecated OpsDirector functionality with security weaknesses. These weaknesses could allow an unauthenticated remote attacker to make unauthorized requests to internal services or forge trusted requests, potentially leading to unauthorized access to protected information. The vulnerability has a high severity score of 7.5 (CVSS 3.1).
CVSS v3.1
Score 7.5high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2026-85963) affects Progress MarkLogic Server 12.x releases prior to 12.1.0 and 11.x releases prior to 11.3.7. It involves deprecated OpsDirector functionality that contains weaknesses enabling an unauthenticated remote attacker to perform unauthorized requests to internal services or forge trusted requests. This could result in unauthorized access to protected information. The CVSS 3.1 base score is 7.5, reflecting a network attack vector with low attack complexity, no privileges required, no user interaction, and high confidentiality impact without integrity or availability impact.
Potential Impact
An unauthenticated remote attacker could exploit the deprecated OpsDirector functionality to make unauthorized requests or forge trusted requests, potentially gaining unauthorized access to protected information. The confidentiality impact is high, but integrity and availability are not affected according to the CVSS vector.
Mitigation Recommendations
A fix is available in Progress MarkLogic Server versions 12.1.0 and 11.3.7 and later. Users should upgrade to these or newer versions to remediate the vulnerability. Patch status is confirmed by the version information in the description. No additional mitigation guidance is provided.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-79mh-8r3q-g9vf
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-85963"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6acd553a2cdf04f656da8320
Added to database: 10/12/2026, 21:46:34 UTC
Last enriched: 10/12/2026, 21:50:23 UTC
Last updated: 10/13/2026, 03:48:07 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.