Threat database

Progress Software Corporation's MarkLogic Server versions 11.x before 11.3.7 and 12.x before 12.1.0, when deployed on Azure, may log sensitive authentication information in diagnostic logs under certain configurations. This vulnerability could allow an attacker with access to these logs to gain unauthorized access to protected cloud resources. A patch is available to address this issue.

Progress Software Corporation MarkLogic Server versions 11.x before 11.3.7 and 12.x before 12.1.0 contain a Cross-Site Request Forgery (CSRF) vulnerability in the Query Console due to the use of predictable CSRF tokens. This flaw allows a remote attacker to trick an authenticated user into submitting unauthorized requests, potentially leading to execution of server-side code with the user's permissions.

Progress MarkLogic Server versions 11.0.0 through before 11.3.7 and 12.0.0 through before 12.1.0 have a vulnerability where successful authentication events are not consistently logged in audit logs. This insufficient logging could hinder detection and investigation of unauthorized access or credential misuse.

Progress MarkLogic Server versions 11.0.0 up to but not including 11.3.7, and 12.0.0 up to but not including 12.1.0, contain an authentication validation weakness. This flaw could allow an attacker to use an invalid token to gain unauthorized access to the server. The vulnerability is classified as CWE-287 (Improper Authentication) and has a high severity rating with a CVSS score of 7.5. There are no known exploits in the wild at this time.

Progress Software Corporation MarkLogic Server versions 11.0.0 up to but not including 11.3.7 have an XML External Entity (XXE) vulnerability due to improper restriction of XML external entity references in the SAML parser configuration. This flaw allows processing of external DTDs or entities, potentially leading to unintended network access or information disclosure. The vulnerability has a high severity with a CVSS score of 7.5. No known exploits are reported in the wild. The issue is fixed starting from version 11.3.7.

CVE-2026-85956 is a critical vulnerability in Progress Software Corporation's MarkLogic Server affecting versions 11.x before 11.3.7 and 12.x before 12.1.0. It allows a remote attacker with delegated database-administrator privileges to perform backup or restore operations on forests outside their authorized database scope. This improper privilege management could lead to unauthorized access or modification of security-critical data.

CVE-2026-85955 is a critical vulnerability in Progress Software Corporation's MarkLogic Server affecting versions 11.x before 11.3.7 and 12.x before 12.1.0. It allows a remote attacker with query-execution access to invoke an XQuery evaluation function without requiring the additional evaluation privilege. This improper privilege management could lead to server-side code execution with elevated permissions, posing a severe risk to confidentiality, integrity, and availability.

CVE-2026-85954 is a high-severity vulnerability in Progress Software Corporation's MarkLogic Server. Versions 11.0.0 up to but not including 11.3.7 and 12.0.0 up to but not including 12.1.0 allow user-controlled values to be evaluated in an elevated security context via certain higher-order XQuery functions. This improper privilege management can lead to privilege escalation beyond the attacker's granted permissions.

CVE-2026-85953 is a high-severity vulnerability in Progress Software Corporation's MarkLogic Server affecting versions 11.0.0 up to but not including 11.3.7, and 12.0.0 up to but not including 12.1.0. It involves improper limitation of a pathname to a restricted directory in privileged legacy InfoStudio modules, which insufficiently validate user-controlled file paths and user-context values. This flaw could allow unauthorized access to server files or execution under an unintended identity.

Progress Software Corporation MarkLogic Server versions 11.0.0 up to but not including 11.3.7 and 12.0.0 up to but not including 12.1.0 on Linux contain a server-side request forgery (SSRF) vulnerability. This flaw allows an authenticated attacker to make unauthorized requests to internal cloud services, potentially leading to unauthorized access to cloud credentials. The vulnerability is identified as CWE-918 and has a high severity score of 8.5. No known exploits are reported in the wild, and the product is not a cloud service. Patch status is not explicitly confirmed in the provided data.

Progress Software Corporation's MarkLogic Server versions 11.x before 11.3.7 and 12.x before 12.1.0 on Azure have a server-side request forgery (SSRF) vulnerability. This flaw allows an authenticated attacker to make unauthorized requests to internal cloud services, potentially leading to unauthorized access to cloud credentials or tokens. The vulnerability has a high severity with a CVSS score of 8.5. A patch is available to remediate this issue. The affected service is cloud-hosted, and the vendor manages remediation for this environment.

Progress MarkLogic Server versions 11.0.0 up to but not including 11.3.7, and 12.0.0 up to but not including 12.1.0, contain an authorization flaw. This flaw allows a remote attacker with administrative privileges to access authentication materials of users with higher privileges. Exploitation could lead to unauthorized administrative access. The vulnerability is identified as CWE-269 (Improper Privilege Management) and has a high severity with a CVSS score of 8.4.

Progress Software Corporation's MarkLogic Server versions 11.0.0 up to but not including 11.3.7, and 12.0.0 up to but not including 12.1.0, may log sensitive security information in diagnostic logs under certain configurations. This could allow an attacker with access to these logs to gain unauthorized access to protected resources. The vulnerability is identified as CWE-532, involving insertion of sensitive information into log files. It has a high severity with a CVSS score of 8.1.

Progress MarkLogic Server versions 11.0.0 up to but not including 11.3.7, and 12.0.0 up to but not including 12.1.0, contain an XQuery injection vulnerability in a deprecated Management API package path. This flaw allows a remote attacker with manage-user-level privileges to gain persistent unauthorized administrative control. The vulnerability is classified as improper privilege management (CWE-269) and has a critical severity with a CVSS score of 9.9.

Progress MarkLogic Server versions 11.0.0 up to but not including 11.3.7, and 12.0.0 up to but not including 12.1.0, contain an authorization flaw in forest-management operations. This flaw allows a remote attacker with forest-management privileges to create a persistent unauthorized administrator account, potentially gaining full administrative control of the server. The vulnerability is rated critical with a CVSS score of 9.9.

CVE-2026-9191 is a critical origin validation vulnerability in Progress Software Corporation's MarkLogic Server. Versions 11.0.0 up to but not including 11.3.7, and 12.0.0 up to but not including 12.1.0, do not properly isolate user-supplied code executed through certain REST and XDBC evaluation paths from HTTP request, response, and session state. This flaw could allow an attacker who can execute code via these paths to perform unauthorized actions or compromise authenticated sessions.

In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account.

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can write arbitrary files to a web-accessible location on the host server.

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root.

In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability in the Scheduled Reports API allows any authenticated user to invoke restricted actions.