CVE-2026-89068 is a high-severity vulnerability in Progress MOVEit Transfer's LDAP module caused by a missing critical step in authentication. It affects versions before 2025.1.6 and versions from 2026.0.0 up to but not including 2026.0.4. The flaw could allow an attacker to compromise confidentiality, integrity, and availability of the system. No known exploits are reported in the wild. No vendor advisory or patch information is provided in the input data.
CVE-2026-89067 is an authentication bypass vulnerability in Progress MOVEit Transfer that allows attackers to bypass authentication using an alternate path or channel. It affects MOVEit Transfer versions before 2025.1.6 and versions from 2026.0.0 up to but not including 2026.0.4. The vulnerability has a high severity with a CVSS score of 8.8, indicating a significant risk to confidentiality, integrity, and availability.
CVE-2026-87093 is a high-severity vulnerability in Progress MOVEit Transfer involving incorrect permission assignment for a critical resource. It affects versions before 2025.1.6 and versions from 2026.0.0 up to but not including 2026.0.4. The vulnerability can lead to complete confidentiality, integrity, and availability compromise of the affected system.
CVE-2026-85976 is a medium severity vulnerability in Progress Software Corporation's MarkLogic Server. Versions 11.0.0 up to but not including 11.3.7, and 12.0.0 up to but not including 12.1.0, do not properly sanitize input to the Query Console file-exploration endpoint. This improper neutralization of CRLF sequences in HTTP headers can lead to HTTP response splitting, potentially causing unintended client-side response handling.
Progress MarkLogic Server versions 11.0.0 up to but not including 11.3.7, and 12.0.0 up to but not including 12.1.0, may transmit sensitive information in cleartext when connecting to Amazon S3 by default. This vulnerability allows a network attacker to intercept data or credentials sent over these connections. The issue is identified as CWE-319 (Cleartext Transmission of Sensitive Information). A fix is available to address this vulnerability.
Progress MarkLogic Server versions 11.x prior to 11.3.7 and 12.x prior to 12.1.0 have a vulnerability where TLS certificate hostnames are not consistently validated for certain outbound connections. This improper validation could allow a network-positioned attacker to intercept or modify communications with the affected service. The vulnerability is identified as CWE-297 and has a CVSS 3.1 score of 7.4, indicating high severity.
Progress Software Corporation MarkLogic Server versions 12.0.0 up to but not including 12.1.0 have a vulnerability involving cleartext transmission of sensitive information in certain cluster-management communications. This allows a network-positioned attacker to intercept or modify data transmitted over affected connections. The vulnerability is identified as CWE-319 and has a CVSS 3.1 score of 7.4, indicating high severity.
Progress MarkLogic Server versions 11.0.0 through before 11.3.7 and 12.0.0 through before 12.1.0 contain an authentication vulnerability. The Kerberos authentication service identity is not sufficiently verified in certain password-based authentication configurations. This flaw could allow a network attacker to impersonate trusted authentication infrastructure, potentially leading to unauthorized access or modification of protected data.
Progress MarkLogic Server versions 11.x before 11.3.7 and 12.x before 12.1.0 have a vulnerability where certain log files are assigned overly permissive operating system permissions. This misconfiguration allows local users to read or modify log data. The issue is addressed by correcting default permissions for newly created and rotated logs, but existing logs retain their original permissions until manually remediated.
CVE-2026-85970 is a high-severity vulnerability in Progress Software Corporation's MarkLogic Server. Versions 11.x before 11.3.7 and 12.x before 12.1.0 enable XML external entity (XXE) processing by default in multiple server paths. This improper restriction of XML external entity references could allow an attacker to craft XML input that triggers server-side requests or discloses local files. The vulnerability has a CVSS 3.1 score of 7.1, indicating a significant confidentiality impact without integrity or availability compromise. No known exploits are reported in the wild, and the product is not a cloud service. Patch status is not explicitly confirmed in the provided data.
Progress MarkLogic Server versions 11.0.0 up to but not including 11.3.7 and 12.0.0 up to but not including 12.1.0 contain an out-of-bounds write vulnerability in language-processing functionality. This flaw allows a remote authenticated attacker to cause server instability or limited data modification. The vulnerability has a high severity with a CVSS score of 7.1. No explicit patch links are provided in the input data.
Progress MarkLogic Server versions 12.0.0 up to but not including 12.1.0 contain an out-of-bounds read vulnerability in query-processing functionality. This flaw allows a remote authenticated attacker to cause server instability or disclose limited information from process memory. The vulnerability is classified as CWE-125 and has a CVSS 3.1 score of 7.1, indicating high severity.
Progress MarkLogic Server versions 11.0.0 up to but not including 11.3.7, and 12.0.0 up to but not including 12.1.0, contain a cross-site scripting (XSS) vulnerability. This flaw allows remote attackers to execute scripts in the context of an authenticated user's browser session, potentially leading to unauthorized actions or disclosure of information accessible to that user. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).
Progress MarkLogic Server versions 11.0.0 through before 11.3.7 and 12.0.0 through before 12.1.0 have an exposure of sensitive information vulnerability. A remote authenticated attacker with limited management permissions could access security-sensitive information that should be restricted. This exposure could lead to unauthorized access to protected resources. The vulnerability has a high severity with a CVSS score of 7.7.
CVE-2026-85965 is a use-after-free vulnerability in Progress Software Corporation's MarkLogic Server affecting versions 11.x before 11.3.7 and 12.x before 12.1.0. The flaw exists in the JavaScript engine integration and can lead to memory corruption, controlled process failure, or server instability. The vulnerability has a high severity with a CVSS score of 8. No known exploits are currently reported in the wild. The affected versions are explicitly stated, and the vulnerability has been publicly disclosed.