MarkLogic Server CVE-2026-85963

Exploitation requires the target MarkLogic Server to have the DEPRECATED OpsDirector functionality present and reachable - this is the specific feature carrying the SSRF weakness. Affected builds are 12.x releases before 12.1.0 and 11.x releases before 11.3.7. Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is needed once OpsDirector is network-reachable. The primary limiting factor is deployment-dependent: instances that do not use/enable OpsDirector, or that restrict network access to the management surface, are not exposed. Impact is confined to unauthorized information disclosure (C:H; no integrity or availability impact).

This is a genuine but conditional priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated vulnerability, and the vendor-assigned 7.5 reflects a pure confidentiality impact (C:H/I:N/A:N) consistent with CWE-918 (SSRF). However, several corroborating risk signals are ABSENT from the input: no EPSS exploitation-probability score is provided, the CVE is NOT in CISA KEV, and no POC/exploit code is referenced - so current status is 'no public exploit identified at time of analysis.' The most important mitigating factor is that exploitation requires the DEPRECATED OpsDirector functionality to be present/enabled; environments not using OpsDirector are not exposed, which materially narrows the real-world attack surface relative to the raw 'unauthenticated network' framing. One signal worth verifying with the vendor: the input tags this as both 'SSRF' and 'Authentication Bypass,' and the description mentions forging 'trusted requests' - if the SSRF can pivot into internal services, an argument exists for a scope-change (S:C) rating rather than the vendor's S:U, which would raise the score; treat the vendor's S:U as authoritative absent further detail. Net: prioritize patching on MarkLogic instances where OpsDirector is enabled; deprioritize where it is confirmed disabled.

A remote, unauthenticated attacker sends crafted requests to the deprecated OpsDirector component of an internet- or network-reachable MarkLogic Server, inducing the server to make attacker-controlled requests to internal services or to forge requests that internal systems treat as trusted. This yields unauthorized read access to protected information behind the server's trust boundary. No public exploit code is referenced in the available data, so weaponization status is unknown.