Threat Intelligence Database

Progress MarkLogic Server versions 11.0.0 up to but not including 11.3.7 and 12.0.0 up to but not including 12.1.0 may transmit Amazon S3 connection data in cleartext by default. This vulnerability allows a network attacker to intercept sensitive information or credentials during transmission. A fix is available to address this issue.

Progress MarkLogic Server versions 11.0.0 up to but not including 11.3.7 and 12.0.0 up to but not including 12.1.0 contain a vulnerability that allows remote authenticated users with limited management permissions to access sensitive security information. This exposure could lead to unauthorized access to protected resources. The vulnerability is classified under CWE-200 and has a high severity rating with a CVSS score of 7.7.

CVE-2026-85956 is a critical improper privilege management vulnerability in Progress Software Corporation's MarkLogic Server. It affects 11.x versions before 11.3.7 and 12.x versions before 12.1.0. A remote attacker with delegated database-administrator privileges can perform backup or restore operations on forests outside their authorized database scope, potentially leading to unauthorized access or modification of sensitive security data.

CVE-2026-85955 is a critical vulnerability in Progress Software Corporation's MarkLogic Server versions 11.x before 11.3.7 and 12.x before 12.1.0. It allows a remote attacker with query-execution access to invoke an XQuery evaluation function without the normally required evaluation privilege. This flaw could lead to server-side code execution with elevated permissions, posing a severe risk to confidentiality, integrity, and availability.

Progress MarkLogic Server versions 11.0.0 up to but not including 11.3.7 and 12.0.0 up to but not including 12.1.0 contain privileged legacy InfoStudio modules with insufficient validation of user-controlled file paths and user-context values. This vulnerability could allow unauthorized access to server files or execution under an unintended identity. The issue is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and CWE-269 (Improper Privilege Management).

Progress MarkLogic Server versions 11.0.0 up to but not including 11.3.7, and 12.0.0 up to but not including 12.1.0, contain an XQuery injection vulnerability in a deprecated Management API package path. This flaw allows a remote attacker with manage-user-level privileges to gain persistent unauthorized administrative control. The vulnerability is classified as improper privilege management (CWE-269) and has a critical severity with a CVSS score of 9.9.