Unauthorized Request Vulnerability in MarkLogic Server by Progress
CVE-2026-85963

7.5HIGH

Key Information:

Vendor

Progress Software
Status
Marklogic Server
Vendor
CVE Published:
12 October 2026

What is CVE-2026-85963?

MarkLogic Server versions prior to 12.1.0 for 12.x and 11.3.7 for 11.x contain a serious security flaw arising from deprecated OpsDirector functionality. This vulnerability enables an unauthenticated remote attacker to exploit weaknesses in the system, allowing unauthorized requests to internal services. Such exploitation can lead to forged requests and possibly unauthorized access to sensitive data, making it crucial for users to update their systems to the latest versions to mitigate potential risks.

Affected Version(s)

MarkLogic Server 11.0.0 < 11.3.7

MarkLogic Server 12.0.0 < 12.1.0

References

https://community.progress.com/s/article/Marklogic-Critic...
vendor-advisory

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.