Marklogic Server
Monthly
Server-side request forgery in Progress MarkLogic Server before 11.3.6 and 12.0.3 enables authenticated low-privileged users to bypass existing IMDS protection filters, causing the server to fetch cloud instance metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254). Successful exploitation yields temporary cloud IAM credentials, extending attacker reach to all cloud resources accessible by the host instance's IAM role. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the Scope:Changed CVSS metric and credential-theft impact elevate operational priority significantly for cloud-hosted deployments.
Stored/reflected cross-site scripting in the Query Console of Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets a remote, unauthenticated attacker execute arbitrary JavaScript in the browser of an authenticated administrator who is lured to a crafted URL. Because the payload runs with the admin's authenticated session, it can harvest credentials/session tokens and perform privileged database and configuration actions on the admin's behalf. Rated CVSS 9.3 (scope-changed); no public exploit identified at time of analysis and not listed in CISA KEV.
Privilege escalation in Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets an authenticated user holding only a low-privileged Hadoop integration role break out of that role and perform privileged operations against the internal Security database, effectively enabling full control over authentication and authorization data. Rated CVSS 9.9 with a changed scope, the flaw turns a minimal Hadoop-connector account into an administrative foothold. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in the ODBC App Server of Progress MarkLogic Server (before 11.3.6 and 12.0.3) lets an unauthenticated remote attacker circumvent password verification and run queries as any named user, including administrators. Because impersonation extends to admin-level accounts, an attacker gains full read/write control over the database and its data. No public exploit has been identified at time of analysis, but the CVSS 9.8 rating and admin-impersonation impact make this a critical, network-reachable flaw.
HTTP request smuggling in Progress MarkLogic Server's HTTP App Server (versions before 11.3.6 and 12.0.3) lets a remote attacker desynchronize request parsing between a fronting reverse proxy and MarkLogic, enabling authentication/authorization bypass, session hijacking, and credential capture. The flaw is exploitable over the network without authentication (PR:N) and carries a critical 9.1 CVSS with high confidentiality and integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; no EPSS score was supplied.
Privilege escalation in Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user holding only a low-privileged REST role to abuse the REST API document patch operation, gaining the ability to run privileged operations against the internal Security database and effectively take over authorization data. Rated CVSS 9.9 with a changed scope, it is exploitable by any low-privileged REST account over the network. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and minimal privilege requirement make it a high-priority patch.
Authentication bypass in Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets an unauthenticated remote attacker forge SAML assertions and impersonate any user, including administrators, on deployments where SAML single sign-on is enabled. The flaw stems from improper cryptographic signature verification (CWE-347) in the SAML authentication module, yielding full identity spoofing over the network with low complexity and no user interaction. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV, but the 9.1 CVSS and pre-authentication admin impersonation make it a high-priority patch.
Privilege escalation in Progress MarkLogic Server before 11.3.6 and 12.0.3 lets an authenticated user holding only a low-privileged REST role elevate to administrator through the SQL, SPARQL, and Optic REST query interfaces, after which they can run privileged operations and read data they were never authorized to see. The flaw is remotely reachable and requires only valid low-tier credentials, driving a critical 9.9 CVSS score. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation in Progress MarkLogic Server's REST API document processing pipeline allows an authenticated user holding an administrative REST role to elevate their access to a higher privilege level, resulting in unauthorized disclosure of sensitive server-side data. Affected versions span both the 11.x and 12.x release trains, patched in 11.3.6 and 12.0.3 respectively per the vendor's August 2026 critical security bulletin. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, though the scope change (S:C) and high confidentiality and integrity impact in the CVSS vector underscore meaningful post-exploitation consequence within the MarkLogic environment.
Cross-site request forgery in the Progress MarkLogic Server Admin UI allows a remote, unauthenticated attacker to trigger unauthorized administrative actions - including changes to security configuration - on behalf of an authenticated administrator who is deceived into visiting a malicious web page. Affected versions span the 11.x line before 11.3.6 and the 12.x line before 12.0.3, with fixes available from Progress Software. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Server-side request forgery in Progress MarkLogic Server before 11.3.6 and 12.0.3 enables authenticated low-privileged users to bypass existing IMDS protection filters, causing the server to fetch cloud instance metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254). Successful exploitation yields temporary cloud IAM credentials, extending attacker reach to all cloud resources accessible by the host instance's IAM role. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the Scope:Changed CVSS metric and credential-theft impact elevate operational priority significantly for cloud-hosted deployments.
Stored/reflected cross-site scripting in the Query Console of Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets a remote, unauthenticated attacker execute arbitrary JavaScript in the browser of an authenticated administrator who is lured to a crafted URL. Because the payload runs with the admin's authenticated session, it can harvest credentials/session tokens and perform privileged database and configuration actions on the admin's behalf. Rated CVSS 9.3 (scope-changed); no public exploit identified at time of analysis and not listed in CISA KEV.
Privilege escalation in Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets an authenticated user holding only a low-privileged Hadoop integration role break out of that role and perform privileged operations against the internal Security database, effectively enabling full control over authentication and authorization data. Rated CVSS 9.9 with a changed scope, the flaw turns a minimal Hadoop-connector account into an administrative foothold. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in the ODBC App Server of Progress MarkLogic Server (before 11.3.6 and 12.0.3) lets an unauthenticated remote attacker circumvent password verification and run queries as any named user, including administrators. Because impersonation extends to admin-level accounts, an attacker gains full read/write control over the database and its data. No public exploit has been identified at time of analysis, but the CVSS 9.8 rating and admin-impersonation impact make this a critical, network-reachable flaw.
HTTP request smuggling in Progress MarkLogic Server's HTTP App Server (versions before 11.3.6 and 12.0.3) lets a remote attacker desynchronize request parsing between a fronting reverse proxy and MarkLogic, enabling authentication/authorization bypass, session hijacking, and credential capture. The flaw is exploitable over the network without authentication (PR:N) and carries a critical 9.1 CVSS with high confidentiality and integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; no EPSS score was supplied.
Privilege escalation in Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user holding only a low-privileged REST role to abuse the REST API document patch operation, gaining the ability to run privileged operations against the internal Security database and effectively take over authorization data. Rated CVSS 9.9 with a changed scope, it is exploitable by any low-privileged REST account over the network. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and minimal privilege requirement make it a high-priority patch.
Authentication bypass in Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets an unauthenticated remote attacker forge SAML assertions and impersonate any user, including administrators, on deployments where SAML single sign-on is enabled. The flaw stems from improper cryptographic signature verification (CWE-347) in the SAML authentication module, yielding full identity spoofing over the network with low complexity and no user interaction. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV, but the 9.1 CVSS and pre-authentication admin impersonation make it a high-priority patch.
Privilege escalation in Progress MarkLogic Server before 11.3.6 and 12.0.3 lets an authenticated user holding only a low-privileged REST role elevate to administrator through the SQL, SPARQL, and Optic REST query interfaces, after which they can run privileged operations and read data they were never authorized to see. The flaw is remotely reachable and requires only valid low-tier credentials, driving a critical 9.9 CVSS score. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation in Progress MarkLogic Server's REST API document processing pipeline allows an authenticated user holding an administrative REST role to elevate their access to a higher privilege level, resulting in unauthorized disclosure of sensitive server-side data. Affected versions span both the 11.x and 12.x release trains, patched in 11.3.6 and 12.0.3 respectively per the vendor's August 2026 critical security bulletin. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, though the scope change (S:C) and high confidentiality and integrity impact in the CVSS vector underscore meaningful post-exploitation consequence within the MarkLogic environment.
Cross-site request forgery in the Progress MarkLogic Server Admin UI allows a remote, unauthenticated attacker to trigger unauthorized administrative actions - including changes to security configuration - on behalf of an authenticated administrator who is deceived into visiting a malicious web page. Affected versions span the 11.x line before 11.3.6 and the 12.x line before 12.0.3, with fixes available from Progress Software. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.