Progress MarkLogic Server versions 11.x before 11.3.7 and 12.x before 12.1.0 have a vulnerability where certain log files are assigned overly permissive operating system permissions. This misconfiguration allows local users to read or modify log data. The issue is addressed by correcting default permissions for newly created and rotated logs, but existing logs retain their original permissions until manually remediated.
CVE-2026-85970 is a high-severity vulnerability in Progress Software Corporation's MarkLogic Server. Versions 11.x before 11.3.7 and 12.x before 12.1.0 enable XML external entity (XXE) processing by default in multiple server paths. This improper restriction of XML external entity references could allow an attacker to craft XML input that triggers server-side requests or discloses local files. The vulnerability has a CVSS 3.1 score of 7.1, indicating a significant confidentiality impact without integrity or availability compromise. No known exploits are reported in the wild, and the product is not a cloud service. Patch status is not explicitly confirmed in the provided data.
Progress MarkLogic Server versions 11.0.0 up to but not including 11.3.7 and 12.0.0 up to but not including 12.1.0 contain an out-of-bounds write vulnerability in language-processing functionality. This flaw allows a remote authenticated attacker to cause server instability or limited data modification. The vulnerability has a high severity with a CVSS score of 7.1. No explicit patch links are provided in the input data.
Progress MarkLogic Server versions 12.0.0 up to but not including 12.1.0 contain an out-of-bounds read vulnerability in query-processing functionality. This flaw allows a remote authenticated attacker to cause server instability or disclose limited information from process memory. The vulnerability is classified as CWE-125 and has a CVSS 3.1 score of 7.1, indicating high severity.
Progress MarkLogic Server versions 11.0.0 up to but not including 11.3.7, and 12.0.0 up to but not including 12.1.0, contain a cross-site scripting (XSS) vulnerability. This flaw allows remote attackers to execute scripts in the context of an authenticated user's browser session, potentially leading to unauthorized actions or disclosure of information accessible to that user. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).
Progress MarkLogic Server versions 11.0.0 through before 11.3.7 and 12.0.0 through before 12.1.0 have an exposure of sensitive information vulnerability. A remote authenticated attacker with limited management permissions could access security-sensitive information that should be restricted. This exposure could lead to unauthorized access to protected resources. The vulnerability has a high severity with a CVSS score of 7.7.
CVE-2026-85965 is a use-after-free vulnerability in Progress Software Corporation's MarkLogic Server affecting versions 11.x before 11.3.7 and 12.x before 12.1.0. The flaw exists in the JavaScript engine integration and can lead to memory corruption, controlled process failure, or server instability. The vulnerability has a high severity with a CVSS score of 8. No known exploits are currently reported in the wild. The affected versions are explicitly stated, and the vulnerability has been publicly disclosed.
CVE-2026-85964 is a high-severity vulnerability in Progress Software Corporation's MarkLogic Server. It affects 11.x versions before 11.3.7 and 12.x versions before 12.1.0. An authenticated Query Console user can supply unsafe path values to a privileged filesystem helper, potentially leading to disclosure of arbitrary server files. The vulnerability is related to improper limitation of a pathname to a restricted directory (CWE-22).
Progress Software Corporation MarkLogic Server versions 11.0.0 through before 11.3.7 and 12.0.0 through before 12.1.0 contain a Server-Side Request Forgery (SSRF) vulnerability in deprecated OpsDirector functionality. This flaw allows an unauthenticated remote attacker to make unauthorized requests to internal services or forge trusted requests, potentially leading to unauthorized access to protected information. The vulnerability has a high severity with a CVSS score of 7.5.
Progress MarkLogic Server versions 11.x before 11.3.7 and 12.x before 12.1.0 contain an improper authentication vulnerability in SAML processing. This flaw allows an unauthenticated remote attacker to cause the server to accept a SAML assertion that should be rejected, potentially leading to unauthorized access. The vulnerability has a high severity rating with a CVSS score of 7.5 and impacts the integrity of the system without affecting confidentiality or availability.
Progress Software Corporation's MarkLogic Server versions 11.x before 11.3.7 and 12.x before 12.1.0, when deployed on Azure, may log sensitive authentication information in diagnostic logs under certain configurations. This vulnerability could allow an attacker with access to these logs to gain unauthorized access to protected cloud resources. A patch is available to address this issue.
Progress Software Corporation MarkLogic Server versions 11.x before 11.3.7 and 12.x before 12.1.0 contain a Cross-Site Request Forgery (CSRF) vulnerability in the Query Console due to the use of predictable CSRF tokens. This flaw allows a remote attacker to trick an authenticated user into submitting unauthorized requests, potentially leading to execution of server-side code with the user's permissions.
Progress MarkLogic Server versions 11.0.0 through before 11.3.7 and 12.0.0 through before 12.1.0 have a vulnerability where successful authentication events are not consistently logged in audit logs. This insufficient logging could hinder detection and investigation of unauthorized access or credential misuse.
Progress MarkLogic Server versions 11.0.0 up to but not including 11.3.7, and 12.0.0 up to but not including 12.1.0, contain an authentication validation weakness. This flaw could allow an attacker to use an invalid token to gain unauthorized access to the server. The vulnerability is classified as CWE-287 (Improper Authentication) and has a high severity rating with a CVSS score of 7.5. There are no known exploits in the wild at this time.
Progress Software Corporation MarkLogic Server versions 11.0.0 up to but not including 11.3.7 have an XML External Entity (XXE) vulnerability due to improper restriction of XML external entity references in the SAML parser configuration. This flaw allows processing of external DTDs or entities, potentially leading to unintended network access or information disclosure. The vulnerability has a high severity with a CVSS score of 7.5. No known exploits are reported in the wild. The issue is fixed starting from version 11.3.7.
CVE-2026-85956 is a critical vulnerability in Progress Software Corporation's MarkLogic Server affecting versions 11.x before 11.3.7 and 12.x before 12.1.0. It allows a remote attacker with delegated database-administrator privileges to perform backup or restore operations on forests outside their authorized database scope. This improper privilege management could lead to unauthorized access or modification of security-critical data.