EUVD-2026-97507
GHSA-92qw-23j4-qrqc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain read access to diagnostic logs
-
ExploitHarvest leaked credentials/secrets
-
ExecutionAuthenticate to protected resource
-
ImpactAccess unauthorized data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A09:2025 - Security Logging & Alerting Failures
ASVS 5.0
V16 - Security Logging and Error Handling Log data sanitization
|
| Exploitation Conditions | Exploitation requires two concrete conditions. First, MarkLogic Server must be running in the specific (unspecified) configuration that causes security-sensitive information to be written to diagnostic logs - the description's 'under certain configurations' means this is NOT default-guaranteed behavior and must be present for data to leak. Second, the attacker must already have read access to the affected diagnostic/error logs (filesystem access to log files, a log-aggregation/SIEM pipeline, backup or archive copies, or an account permitted to view logs), which is why the vendor sets PR:L rather than PR:N. Limiting factors: the leak is configuration-dependent, prior log access is mandatory, and impact is bounded by which sensitive values the logs actually contain; affected versions are limited to 11.x before 11.3.7 and 12.x before 12.1.0. |
| Impact | This is a moderate-priority issue rather than an emergency, and the input signals conflict in ways defenders must resolve. The vendor CVSS (8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) is internally inconsistent with the vulnerability type: CWE-532 (sensitive information written to logs) is fundamentally a confidentiality weakness, yet the vector sets C:N while marking I:H and A:H - verify the scoring with Progress, since the direct impact of leaked log data is almost certainly confidentiality, not integrity/availability. No EPSS score, CISA KEV status, POC, or SSVC data was provided. Exploitation is gated by a real prerequisite the raw 'network vector' obscures: the attacker must first have access to the affected diagnostic logs (reflected by PR:L), and sensitive data is only written 'under certain configurations,' so this is not a drive-by remote-unauthenticated break. Net assessment: elevated but not critical - treat as an important hardening and credential-rotation item on affected MarkLogic deployments, prioritized by whoever can reach the log files, not as an actively-exploited perimeter flaw. |
| Exploit ScenarioDerived | On a MarkLogic Server running an affected 11.x or 12.x build in the vulnerable configuration, an attacker who can read the diagnostic/error logs (e.g., a low-privileged user, a log-aggregation account, or someone who obtained archived logs) finds security-sensitive data such as credentials or tokens recorded there. They replay that information to authenticate to protected resources they were not authorized to reach. No public exploit identified at time of analysis, and the attack depends on the sensitive-logging configuration actually being active. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
MarkLogic Server 11.x before 11.3.7 and 12.x before 12.1.0 can write security-sensitive values - information that enables access to protected resources - into diagnostic logs when the server is running in specific, non-default configurations. Anyone who can already read those logs (filesystem access, a log-aggregation/SIEM pipeline, backup or archive copies, or an account permitted to view logs) can harvest that data and use it to obtain unauthorized access, so the exposure is genuine but gated on two preconditions: a particular logging configuration must be present, and the attacker must already hold low-privileged log read access. No public exploit code or confirmed active exploitation (no CISA KEV listing) was identified at time of analysis, and the independent assessment rates this as a confidentiality-only, local-context issue (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), making it a moderate-priority hardening problem rather than an emergency despite the 8.1 vendor score.
RemediationAI
Vendor-released patch: upgrade to MarkLogic Server 11.3.7 (for the 11.x train) or 12.1.0 (for the 12.x train), the versions at which the affected ranges end, and follow the Progress bulletin at https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-October-2026 for the official installation and configuration steps. Until upgrades complete, apply targeted compensating controls rather than generic advice: first, treat MarkLogic diagnostic and error logs as sensitive data - tighten file permissions and ACLs on log directories so only the service account and a minimal admin group can read them, accepting that this may break existing engineering workflows that tail logs directly; second, remove MarkLogic diagnostic logs from broadly readable log-aggregation or SIEM pipelines, or restrict those consumers to a dedicated privileged index, with the trade-off of reduced visibility for operations staff and potential ingestion-pipeline reconfiguration; third, reduce log verbosity or disable debug-level logging on the affected components so the sensitive material is not emitted in the first place, at the cost of degraded troubleshooting and audit detail; fourth, shorten retention and securely purge or rotate existing diagnostic logs and any archives or backups that may contain leaked values, since fixing the server does not un-leak already-written data. Because credentials or tokens may have been exposed, rotate any secrets that could plausibly appear in the logs and review log access records for unexpected readers. Finally, note that no patch version should be assumed beyond the 11.3.7 and 12.1.0 boundaries stated in the vendor description, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-532 (Insertion of Sensitive Information into Log File): MarkLogic Server's diagnostics/error logging path can serialize security-sensitive material - credentials, tokens, or similarly privileged values - into log output rather than redacting or hashing it. The CPE cpe:2.3:a:progress_software_corporation:marklogic_server confirms Progress Software Corporation's MarkLogic Server is the sole affected product family, across the 11.x and 12.x release trains. Critically, the vendor description qualifies the behavior as occurring 'under certain configurations', meaning the leak is not guaranteed in a default deployment and depends on how verbose logging, debug levels, or specific components are configured. The independent assessment therefore re-scopes the issue to a local attack vector (AV:L) with high confidentiality impact only (C:H/I:N/A:N): the flaw does not by itself grant code execution, integrity, or availability impact, and it does not let an attacker without log access read anything. The exploit chain is purely a data-exfiltration-from-logs problem, magnified in real environments by centralized log shipping, where log content is copied to multiple systems and readable by operations, support, and SIEM personnel well beyond the server host.
Know when Marklogic Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Reading sensitive data from local log files needs some authenticated/log access, so AV:L and PR:L; the core impact is disclosure (C:H), with I/A not directly affected by the logging weakness itself.
Primary rating from Vendor (ProgressSoftware).
CVSS VectorVendor: ProgressSoftware
Lifecycle Timeline
2DescriptionCVE.org
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive information in diagnostic logs under certain configurations. An attacker with access to the affected logs could use this information to obtain unauthorized access to protected resources.
Executive ViewAI
MarkLogic Server versions 11.x before 11.3.7 and 12.x before 12.1.0 can expose security-sensitive information through diagnostic logs when running in non-default configurations, potentially allowing an authenticated user with log read access to obtain data that enables unauthorized access to protected resources. This vulnerability is assessed as a moderate-priority hardening issue because exploitation requires both a specific logging configuration and low-privileged log access, and no public exploit identified at time of analysis. Leadership should direct teams to review logging configurations and restrict log access to reduce the risk of data exposure.
No vendor-released patch identified at time of analysis; implement interim mitigations: restrict log file access to only essential personnel, enable log redaction if supported, monitor log access for anomalies, and consider disabling the non-default logging configuration that triggers the exposure.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Marklogic Server
View allAuthenticated XQuery injection in Progress MarkLogic Server 11.x before 11.3.7 and 12.x before 12.1.0 allows a remote at
An authenticated privilege-escalation flaw in Progress MarkLogic Server lets an attacker who already holds forest-manage
Privilege escalation in Progress MarkLogic Server before 11.3.6 and 12.0.3 lets an authenticated user holding only a low
Privilege escalation in Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets an authenticated user holding
Privilege escalation in Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user holding only a l
Authentication bypass in the ODBC App Server of Progress MarkLogic Server (before 11.3.6 and 12.0.3) lets an unauthentic
Insufficient isolation in Progress MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7 allows code executed throu
Stored/reflected cross-site scripting in the Query Console of Progress MarkLogic Server (versions before 11.3.6 and 12.0
HTTP request smuggling in Progress MarkLogic Server's HTTP App Server (versions before 11.3.6 and 12.0.3) lets a remote
Authentication bypass in Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets an unauthenticated remote at
Cross-site request forgery in the Progress MarkLogic Server Admin UI allows a remote attacker to perform privileged admi
Server-side request forgery in Progress MarkLogic Server before 11.3.6 and 12.0.3 enables authenticated low-privileged u
Exploit-DB