Marklogic Server
Monthly
Cleartext transmission of Amazon S3 credentials and data in Progress MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7 allows a network-positioned attacker to intercept sensitive information when S3 integration is left on default transport settings. Exploitation is unauthenticated but requires the S3 feature to be in use, the default cleartext transport to be unchanged, and an on-path man-in-the-middle position; deployments using TLS, VPC endpoints, or VPNs are not at risk. No public exploit code has been identified at time of analysis, and our assessment rates this as AC:H rather than AC:L due to these prerequisites.
Outbound TLS connections initiated by Progress MarkLogic Server can be intercepted and modified by an on-path attacker because the product does not consistently validate the certificate hostname for certain outbound connections (CWE-297). Affected are 12.x releases before 12.1.0 and 11.x releases before 11.3.7; the vulnerability is unauthenticated from the attacker's perspective (CVSS:3.1/AV:N/AC:H/PR:N/UI:N) but requires the attacker to first occupy a man-in-the-middle position - for example via ARP or DNS spoofing, a rogue gateway, or control of intermediate network infrastructure - and requires MarkLogic to actually open one of the specific outbound connections that skip hostname verification. Impact is limited to confidentiality and integrity of those communications (C:H/I:H) with no availability impact and no code execution; no public exploit code or active exploitation has been identified at time of analysis.
Cleartext transmission of certain cluster-management communications in Progress MarkLogic Server 12.x releases before 12.1.0 allows an on-path attacker to read and modify inter-node management data, compromising both confidentiality and integrity of cluster operations. The vendor CVSS is 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N): exploitation requires no authentication and no user interaction, but the attacker must already occupy a man-in-the-middle position on the network segment carrying MarkLogic cluster traffic, which in well-segmented environments is a trusted internal VLAN not reachable from general user networks - realistically limiting exposure to insiders or attackers who have already achieved lateral movement. Availability is unaffected, and no public exploit identified at time of analysis.
Kerberos authentication service impersonation in Progress MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7 lets an unauthenticated, suitably positioned network attacker impersonate trusted authentication infrastructure, potentially resulting in unauthorized access to or modification of protected data. Exploitation is conditional: it requires a deployment configured with Kerberos-backed password-based (external) authentication and an attacker holding a privileged on-path network position between the server and the Kerberos KDC, which is why CVSS rates attack complexity as high despite no required user interaction or prior authentication. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Progress MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7 create certain log files with overly permissive operating-system permissions, allowing a local, already-authenticated low-privilege user on the server host to read or alter log data (CWE-732). Exploitation requires local OS access to the MarkLogic host (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) and is not remotely reachable, so the practical risk is moderate and concentrated on multi-tenant or multi-user hosts where untrusted local accounts exist; no public exploit identified at time of analysis. Notably, the vendor fix only corrects the default permissions for newly created and rotated logs, so previously written log files on an upgraded host remain permissively accessible until an administrator manually remediates them.
XML external entity (XXE) processing is enabled by default across multiple request paths in Progress MarkLogic Server 11.x before 11.3.7 and 12.x before 12.1.0, allowing an attacker who submits crafted XML to trigger server-side requests or read local files. The vulnerability is rated CVSS 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L), meaning exploitation requires at least low-privileged credentials or an existing authenticated session - it is not an unauthenticated flaw - and the impact is limited to confidentiality loss and minor availability effects, with no integrity impact. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so exposure is currently a matter of unpatched, authenticated attack surface rather than active exploitation. Progress has published a security advisory and fixed releases that disable default external entity processing.
An out-of-bounds write in the language-processing functionality of Progress MarkLogic Server lets an authenticated remote user with only low-level privileges crash or destabilize the server and, more narrowly, modify limited data. Only MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 are affected; the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) confirms availability is the dominant impact while confidentiality is untouched and integrity impact is limited. The mandatory pre-existing authenticated session is the primary limiting factor, so the realistic threat is an insider or an attacker who already holds valid credentials, and no public exploit code and no confirmed active exploitation were identified at time of analysis.
An out-of-bounds read in Progress MarkLogic Server 12.x query-processing functionality allows an authenticated remote attacker to crash or destabilize the server and to read a limited amount of data from process memory by submitting specially crafted input to the affected query routines. The flaw affects MarkLogic Server 12.x releases before 12.1.0; environments on 12.1.0 or later, or on other major branches, are out of scope. Exploitation requires valid low-privilege credentials (CVSS PR:L) plus network reachability to the query interface - this is not an unauthenticated flaw - and no user interaction is needed. Vendor-released patch: 12.1.0. No confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; CVSS 3.1 base score is 7.1 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H, driven primarily by the high availability impact of induced server instability.
Insufficient access controls in Progress MarkLogic Server 12.x (before 12.1.0) and 11.x (before 11.3.7) allow a remote, authenticated attacker holding only limited management privileges to read security-sensitive information, which can then be used to reach protected resources outside that account's intended scope. The CVE carries a 7.7 score with a scope-changing vector (S:C) because the confidentiality impact crosses a privilege boundary, but exploitation is gated on the attacker already possessing a valid low-privilege management account (PR:L), and no user interaction is required. No public exploit code and no CISA KEV listing were identified at time of analysis, so real-world exposure concentrates in multi-tenant or role-segmented installations, or as a lateral-movement step after an initial account compromise.
Memory corruption through a use-after-free (CWE-416) in the JavaScript engine integration of Progress MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7 can lead to controlled process failure, server instability, or corrupted memory state. Exploitation is not anonymous: the assessed vector (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) requires a high-privileged account that can already execute server-side JavaScript, and the high attack complexity indicates the defect depends on specific timing or state conditions that are not reliably achievable on demand - so realistic abuse is confined to trusted, insider, or post-compromise contexts. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released fixed versions 12.1.0 (12.x track) and 11.3.7 (11.x track).
Authenticated users of the MarkLogic Query Console can read arbitrary files from the underlying server by supplying unsafe path values to a privileged filesystem helper, a classic path-traversal disclosure (CWE-22). The issue affects MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7, and carries a CVSS 3.1 base score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), meaning a network-reachable, low-complexity attack by an authenticated principal that yields high confidentiality impact with no integrity or availability effect and a scope change because the helper runs with privileges beyond the caller's own. Because exploitation requires valid Query Console credentials, this is a credible moderate-to-high priority patching item rather than a drop-everything emergency; no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated remote attackers can exploit deprecated OpsDirector functionality in Progress MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7 to perform server-side request forgery (SSRF), making unauthorized requests to internal services or forging trusted requests that may expose protected information. Exploitation is conditional on the OpsDirector component being present and network-reachable; no public exploit code has been identified at time of analysis. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates high confidentiality impact with no integrity or availability impact.
Improper validation of SAML assertions in Progress MarkLogic Server lets an unauthenticated remote attacker cause the server to accept an assertion that should have been rejected, potentially yielding unauthorized access to the MarkLogic deployment and its data. Affected are 12.x releases before 12.1.0 and 11.x releases before 11.3.7, but only instances explicitly configured to use SAML authentication and whose SAML endpoints are network-reachable are exposed to this flaw. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no credentials and no user interaction are required; no public exploit code was identified at time of analysis, and the vendor has published fixed versions 12.1.0 and 11.3.7.
Progress MarkLogic Server deployments on Microsoft Azure running 12.x releases before 12.1.0 or 11.x releases before 11.3.7 can write security-sensitive authentication information into diagnostic logs under a specific, non-default configuration, allowing anyone with read access to those logs to harvest credentials or secrets and use them to reach protected cloud resources. The exposure is confidentiality-only: the vulnerability itself provides no code execution, integrity, or availability impact, and it is limited to Azure-hosted deployments - on-premises and other non-Azure installations appear out of scope. Exploitation requires an attacker to already have access to the diagnostic logs (through log storage, a log aggregation pipeline, or insider/lateral access) and requires the triggering configuration to be present; no public exploit code and no confirmed active exploitation were identified at time of analysis. Note that the vendor-published CVSS 3.1 vector (AV:N/AC:L/PR:N, 7.5) describes a remote unauthenticated attack, which conflicts with the description, CWE-532, and our assessed vector (AV:L/AC:H/PR:L, confidentiality-only), so the practical attack path should be treated as a log-access-dependent secret disclosure rather than an unauthenticated remote breach.
Progress MarkLogic Server deployments in the 12.x line before 12.1.0 and the 11.x line before 11.3.7 generate predictable anti-CSRF tokens for Query Console, allowing a remote attacker to forge requests that pass CSRF validation and execute server-side code with the permissions of a logged-in victim. Exploitation is conditional: the attacker must lure a user who currently holds a live authenticated Query Console session to an attacker-controlled page, so user interaction is mandatory and unattended servers or logged-out users are not reachable this way. A vendor advisory is available (community.progress.com MarkLogic Critical Security Alert Bulletin, October 2026) and confirmed fixed versions exist; there is no CISA KEV entry and no public exploit code identified at time of analysis, and no EPSS score was supplied, so this is best treated as a credible but conditional risk rather than a drop-everything emergency.
MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 fail to consistently write successful authentication events to the audit log, which degrades a customer's ability to detect and investigate unauthorized access or credential misuse. The exposure is limited to logging/visibility: independent assessment rates the impact as integrity-only against the audit record (C:N/I:L/A:N), and the flaw gives an attacker no access by itself - harm only materialises after a separate successful authentication with legitimate or stolen credentials. There is no public exploit identified at time of analysis, and remediation is an upgrade to 12.1.0 or 11.3.7 or later.
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 validate authentication tokens incorrectly, accepting a token the server should reject, so a remote attacker who can reach the instance can obtain unauthorized access under that token's identity. The vendor-published CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), while our independent assessment raises the confidentiality impact to High (C:H/I:H/A:N), reflecting that an improperly accepted token may expose data as well as permit modification; neither vector assesses any availability impact. No public exploit code or confirmed active exploitation was identified at time of analysis (the CVE is not in CISA KEV) and no EPSS score was available in the supplied data, so the realistic limiting factor is deployment exposure: the MarkLogic instance must be network-reachable by the attacker.
XML external entity (XXE) processing in Progress MarkLogic Server 11.x before 11.3.7 allows remote, unauthenticated attackers to disclose local files or trigger outbound network requests from the server through attacker-supplied SAML messages. Exploitation is conditional: the instance must be configured to use SAML single sign-on, since only the SAML parser's handling of external DTDs and entities is affected, and the impact is limited to confidentiality (C:H, no integrity or availability impact, CVSS 7.5). No public exploit code and no confirmed active exploitation have been identified at time of analysis, so this represents a genuine but conditional priority - patching matters most for deployments that have SAML SSO enabled and exposed to untrusted networks.
Privilege escalation in Progress MarkLogic Server affects 11.x releases before 11.3.7 and 12.x releases before 12.1.0, where an attacker who already holds an administrative account can reach authentication material belonging to higher-privileged users and use it to obtain unauthorized administrative access (CWE-269, CVSS 8.4 with scope change). Exploitation is gated by pre-existing admin privileges, so this is primarily an insider or post-compromise escalation risk rather than an externally reachable entry point; no public exploit has been identified at time of analysis and there is no CISA KEV association. No EPSS score was supplied in the available intelligence, so likelihood estimates should be treated as unquantified.
MarkLogic Server 11.x before 11.3.7 and 12.x before 12.1.0 can write security-sensitive values - information that enables access to protected resources - into diagnostic logs when the server is running in specific, non-default configurations. Anyone who can already read those logs (filesystem access, a log-aggregation/SIEM pipeline, backup or archive copies, or an account permitted to view logs) can harvest that data and use it to obtain unauthorized access, so the exposure is genuine but gated on two preconditions: a particular logging configuration must be present, and the attacker must already hold low-privileged log read access. No public exploit code or confirmed active exploitation (no CISA KEV listing) was identified at time of analysis, and the independent assessment rates this as a confidentiality-only, local-context issue (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), making it a moderate-priority hardening problem rather than an emergency despite the 8.1 vendor score.
Authenticated XQuery injection in Progress MarkLogic Server 11.x before 11.3.7 and 12.x before 12.1.0 allows a remote attacker who already holds a manage-user-level account to escalate to persistent unauthorized administrative control of the database. The flaw resides in a deprecated Management API package path and carries a 9.9 CVSS score because exploitation crosses a security boundary (S:C) and fully compromises confidentiality, integrity, and availability. It is not a pre-authentication issue - a valid manage-user credential is mandatory - and no public exploit code has been identified at time of analysis, so risk is concentrated in environments where the Management API is network-exposed and manage-user grants are loosely administered.
An authenticated privilege-escalation flaw in Progress MarkLogic Server lets an attacker who already holds forest-management privileges create a persistent, unauthorized administrator account, resulting in complete administrative control of the server. Affected are 12.x releases before 12.1.0 and 11.x releases before 11.3.7; the vulnerability is reachable over the network (AV:N) with low privileges (PR:L) and no user interaction, and it is rated 9.9 because a successful escalation changes scope, giving the attacker high confidentiality, integrity and availability impact across the deployment. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (no CISA KEV listing); the practical risk is concentrated in deployments that delegate forest-management rights to non-super-admin or duty-separated roles, since an attacker must first possess that privilege to exploit the flaw.
Insufficient isolation in Progress MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7 allows code executed through REST Client API and XDBC evaluation paths to reach the surrounding HTTP request, response, and session state, enabling unauthorized actions or compromise of an authenticated user's session. The vendor scores this 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), but the scope change and full confidentiality/integrity/availability impact only materialize when an attacker can reach an evaluation interface and a victim with an authenticated session triggers it; our assessment rates the prerequisite as authenticated (PR:L) rather than unauthenticated, so exposure is limited to deployments where these endpoints are reachable and in use. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (no CISA KEV listing) as of this report.
Server-side request forgery in Progress MarkLogic Server before 11.3.6 and 12.0.3 enables authenticated low-privileged users to bypass existing IMDS protection filters, causing the server to fetch cloud instance metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254). Successful exploitation yields temporary cloud IAM credentials, extending attacker reach to all cloud resources accessible by the host instance's IAM role. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the Scope:Changed CVSS metric and credential-theft impact elevate operational priority significantly for cloud-hosted deployments.
Stored/reflected cross-site scripting in the Query Console of Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets a remote, unauthenticated attacker execute arbitrary JavaScript in the browser of an authenticated administrator who is lured to a crafted URL. Because the payload runs with the admin's authenticated session, it can harvest credentials/session tokens and perform privileged database and configuration actions on the admin's behalf. Rated CVSS 9.3 (scope-changed); no public exploit identified at time of analysis and not listed in CISA KEV.
Privilege escalation in Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets an authenticated user holding only a low-privileged Hadoop integration role break out of that role and perform privileged operations against the internal Security database, effectively enabling full control over authentication and authorization data. Rated CVSS 9.9 with a changed scope, the flaw turns a minimal Hadoop-connector account into an administrative foothold. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in the ODBC App Server of Progress MarkLogic Server (before 11.3.6 and 12.0.3) lets an unauthenticated remote attacker circumvent password verification and run queries as any named user, including administrators. Because impersonation extends to admin-level accounts, an attacker gains full read/write control over the database and its data. No public exploit has been identified at time of analysis, but the CVSS 9.8 rating and admin-impersonation impact make this a critical, network-reachable flaw.
HTTP request smuggling in Progress MarkLogic Server's HTTP App Server (versions before 11.3.6 and 12.0.3) lets a remote attacker desynchronize request parsing between a fronting reverse proxy and MarkLogic, enabling authentication/authorization bypass, session hijacking, and credential capture. The flaw is exploitable over the network without authentication (PR:N) and carries a critical 9.1 CVSS with high confidentiality and integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; no EPSS score was supplied.
Privilege escalation in Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user holding only a low-privileged REST role to abuse the REST API document patch operation, gaining the ability to run privileged operations against the internal Security database and effectively take over authorization data. Rated CVSS 9.9 with a changed scope, it is exploitable by any low-privileged REST account over the network. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and minimal privilege requirement make it a high-priority patch.
Authentication bypass in Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets an unauthenticated remote attacker forge SAML assertions and impersonate any user, including administrators, on deployments where SAML single sign-on is enabled. The flaw stems from improper cryptographic signature verification (CWE-347) in the SAML authentication module, yielding full identity spoofing over the network with low complexity and no user interaction. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV, but the 9.1 CVSS and pre-authentication admin impersonation make it a high-priority patch.
Privilege escalation in Progress MarkLogic Server before 11.3.6 and 12.0.3 lets an authenticated user holding only a low-privileged REST role elevate to administrator through the SQL, SPARQL, and Optic REST query interfaces, after which they can run privileged operations and read data they were never authorized to see. The flaw is remotely reachable and requires only valid low-tier credentials, driving a critical 9.9 CVSS score. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation in Progress MarkLogic Server's REST API document processing pipeline allows an authenticated user holding an administrative REST role to elevate their access to a higher privilege level, resulting in unauthorized disclosure of sensitive server-side data. Affected versions span both the 11.x and 12.x release trains, patched in 11.3.6 and 12.0.3 respectively per the vendor's August 2026 critical security bulletin. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, though the scope change (S:C) and high confidentiality and integrity impact in the CVSS vector underscore meaningful post-exploitation consequence within the MarkLogic environment.
Cross-site request forgery in the Progress MarkLogic Server Admin UI allows a remote attacker to perform privileged administrative actions on behalf of a logged-in administrator by luring them to a crafted malicious webpage. Affected versions span the 11.x line prior to 11.3.6 and the 12.x line prior to 12.0.3, covering deployments across both active release trains. No public exploit code or active exploitation has been identified; Progress Software has issued patches for both branches.
HTTP response splitting in Progress MarkLogic Server affects the Query Console file-exploration endpoint in 12.x releases before 12.1.0 and 11.x releases before 11.3.7, where insufficient input sanitization permits CR/LF injection into generated HTTP responses. Exploitation requires an authenticated Query Console session (CVSS PR:L) and a victim to trigger the attacker-influenced request (UI:R), so it is not a fully automated remote attack; the impact is a scope-changed, low-severity client-side response manipulation with limited confidentiality and integrity effects and no availability impact, consistent with a CVSS 3.1 base score of 5.4. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied with the source data.
Cross-site scripting in Progress MarkLogic Server lets a remote, unauthenticated attacker execute arbitrary script in the browser of an authenticated MarkLogic user - typically an administrator or developer working in the web-based Admin or Query console - after that user clicks a crafted link or loads attacker-supplied content. Only 12.x releases before 12.1.0 and 11.x releases before 11.3.7 are affected; the flaw is rated CVSS 3.1 base 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), with the required victim interaction and the need for an existing authenticated session being the main limiting factors. Successful exploitation could drive unauthorized actions or expose information accessible to that authenticated user, and no public exploit code has been identified at time of analysis.
Cleartext transmission of Amazon S3 credentials and data in Progress MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7 allows a network-positioned attacker to intercept sensitive information when S3 integration is left on default transport settings. Exploitation is unauthenticated but requires the S3 feature to be in use, the default cleartext transport to be unchanged, and an on-path man-in-the-middle position; deployments using TLS, VPC endpoints, or VPNs are not at risk. No public exploit code has been identified at time of analysis, and our assessment rates this as AC:H rather than AC:L due to these prerequisites.
Outbound TLS connections initiated by Progress MarkLogic Server can be intercepted and modified by an on-path attacker because the product does not consistently validate the certificate hostname for certain outbound connections (CWE-297). Affected are 12.x releases before 12.1.0 and 11.x releases before 11.3.7; the vulnerability is unauthenticated from the attacker's perspective (CVSS:3.1/AV:N/AC:H/PR:N/UI:N) but requires the attacker to first occupy a man-in-the-middle position - for example via ARP or DNS spoofing, a rogue gateway, or control of intermediate network infrastructure - and requires MarkLogic to actually open one of the specific outbound connections that skip hostname verification. Impact is limited to confidentiality and integrity of those communications (C:H/I:H) with no availability impact and no code execution; no public exploit code or active exploitation has been identified at time of analysis.
Cleartext transmission of certain cluster-management communications in Progress MarkLogic Server 12.x releases before 12.1.0 allows an on-path attacker to read and modify inter-node management data, compromising both confidentiality and integrity of cluster operations. The vendor CVSS is 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N): exploitation requires no authentication and no user interaction, but the attacker must already occupy a man-in-the-middle position on the network segment carrying MarkLogic cluster traffic, which in well-segmented environments is a trusted internal VLAN not reachable from general user networks - realistically limiting exposure to insiders or attackers who have already achieved lateral movement. Availability is unaffected, and no public exploit identified at time of analysis.
Kerberos authentication service impersonation in Progress MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7 lets an unauthenticated, suitably positioned network attacker impersonate trusted authentication infrastructure, potentially resulting in unauthorized access to or modification of protected data. Exploitation is conditional: it requires a deployment configured with Kerberos-backed password-based (external) authentication and an attacker holding a privileged on-path network position between the server and the Kerberos KDC, which is why CVSS rates attack complexity as high despite no required user interaction or prior authentication. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Progress MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7 create certain log files with overly permissive operating-system permissions, allowing a local, already-authenticated low-privilege user on the server host to read or alter log data (CWE-732). Exploitation requires local OS access to the MarkLogic host (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) and is not remotely reachable, so the practical risk is moderate and concentrated on multi-tenant or multi-user hosts where untrusted local accounts exist; no public exploit identified at time of analysis. Notably, the vendor fix only corrects the default permissions for newly created and rotated logs, so previously written log files on an upgraded host remain permissively accessible until an administrator manually remediates them.
XML external entity (XXE) processing is enabled by default across multiple request paths in Progress MarkLogic Server 11.x before 11.3.7 and 12.x before 12.1.0, allowing an attacker who submits crafted XML to trigger server-side requests or read local files. The vulnerability is rated CVSS 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L), meaning exploitation requires at least low-privileged credentials or an existing authenticated session - it is not an unauthenticated flaw - and the impact is limited to confidentiality loss and minor availability effects, with no integrity impact. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so exposure is currently a matter of unpatched, authenticated attack surface rather than active exploitation. Progress has published a security advisory and fixed releases that disable default external entity processing.
An out-of-bounds write in the language-processing functionality of Progress MarkLogic Server lets an authenticated remote user with only low-level privileges crash or destabilize the server and, more narrowly, modify limited data. Only MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 are affected; the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) confirms availability is the dominant impact while confidentiality is untouched and integrity impact is limited. The mandatory pre-existing authenticated session is the primary limiting factor, so the realistic threat is an insider or an attacker who already holds valid credentials, and no public exploit code and no confirmed active exploitation were identified at time of analysis.
An out-of-bounds read in Progress MarkLogic Server 12.x query-processing functionality allows an authenticated remote attacker to crash or destabilize the server and to read a limited amount of data from process memory by submitting specially crafted input to the affected query routines. The flaw affects MarkLogic Server 12.x releases before 12.1.0; environments on 12.1.0 or later, or on other major branches, are out of scope. Exploitation requires valid low-privilege credentials (CVSS PR:L) plus network reachability to the query interface - this is not an unauthenticated flaw - and no user interaction is needed. Vendor-released patch: 12.1.0. No confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; CVSS 3.1 base score is 7.1 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H, driven primarily by the high availability impact of induced server instability.
Insufficient access controls in Progress MarkLogic Server 12.x (before 12.1.0) and 11.x (before 11.3.7) allow a remote, authenticated attacker holding only limited management privileges to read security-sensitive information, which can then be used to reach protected resources outside that account's intended scope. The CVE carries a 7.7 score with a scope-changing vector (S:C) because the confidentiality impact crosses a privilege boundary, but exploitation is gated on the attacker already possessing a valid low-privilege management account (PR:L), and no user interaction is required. No public exploit code and no CISA KEV listing were identified at time of analysis, so real-world exposure concentrates in multi-tenant or role-segmented installations, or as a lateral-movement step after an initial account compromise.
Memory corruption through a use-after-free (CWE-416) in the JavaScript engine integration of Progress MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7 can lead to controlled process failure, server instability, or corrupted memory state. Exploitation is not anonymous: the assessed vector (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) requires a high-privileged account that can already execute server-side JavaScript, and the high attack complexity indicates the defect depends on specific timing or state conditions that are not reliably achievable on demand - so realistic abuse is confined to trusted, insider, or post-compromise contexts. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released fixed versions 12.1.0 (12.x track) and 11.3.7 (11.x track).
Authenticated users of the MarkLogic Query Console can read arbitrary files from the underlying server by supplying unsafe path values to a privileged filesystem helper, a classic path-traversal disclosure (CWE-22). The issue affects MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7, and carries a CVSS 3.1 base score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), meaning a network-reachable, low-complexity attack by an authenticated principal that yields high confidentiality impact with no integrity or availability effect and a scope change because the helper runs with privileges beyond the caller's own. Because exploitation requires valid Query Console credentials, this is a credible moderate-to-high priority patching item rather than a drop-everything emergency; no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated remote attackers can exploit deprecated OpsDirector functionality in Progress MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7 to perform server-side request forgery (SSRF), making unauthorized requests to internal services or forging trusted requests that may expose protected information. Exploitation is conditional on the OpsDirector component being present and network-reachable; no public exploit code has been identified at time of analysis. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates high confidentiality impact with no integrity or availability impact.
Improper validation of SAML assertions in Progress MarkLogic Server lets an unauthenticated remote attacker cause the server to accept an assertion that should have been rejected, potentially yielding unauthorized access to the MarkLogic deployment and its data. Affected are 12.x releases before 12.1.0 and 11.x releases before 11.3.7, but only instances explicitly configured to use SAML authentication and whose SAML endpoints are network-reachable are exposed to this flaw. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no credentials and no user interaction are required; no public exploit code was identified at time of analysis, and the vendor has published fixed versions 12.1.0 and 11.3.7.
Progress MarkLogic Server deployments on Microsoft Azure running 12.x releases before 12.1.0 or 11.x releases before 11.3.7 can write security-sensitive authentication information into diagnostic logs under a specific, non-default configuration, allowing anyone with read access to those logs to harvest credentials or secrets and use them to reach protected cloud resources. The exposure is confidentiality-only: the vulnerability itself provides no code execution, integrity, or availability impact, and it is limited to Azure-hosted deployments - on-premises and other non-Azure installations appear out of scope. Exploitation requires an attacker to already have access to the diagnostic logs (through log storage, a log aggregation pipeline, or insider/lateral access) and requires the triggering configuration to be present; no public exploit code and no confirmed active exploitation were identified at time of analysis. Note that the vendor-published CVSS 3.1 vector (AV:N/AC:L/PR:N, 7.5) describes a remote unauthenticated attack, which conflicts with the description, CWE-532, and our assessed vector (AV:L/AC:H/PR:L, confidentiality-only), so the practical attack path should be treated as a log-access-dependent secret disclosure rather than an unauthenticated remote breach.
Progress MarkLogic Server deployments in the 12.x line before 12.1.0 and the 11.x line before 11.3.7 generate predictable anti-CSRF tokens for Query Console, allowing a remote attacker to forge requests that pass CSRF validation and execute server-side code with the permissions of a logged-in victim. Exploitation is conditional: the attacker must lure a user who currently holds a live authenticated Query Console session to an attacker-controlled page, so user interaction is mandatory and unattended servers or logged-out users are not reachable this way. A vendor advisory is available (community.progress.com MarkLogic Critical Security Alert Bulletin, October 2026) and confirmed fixed versions exist; there is no CISA KEV entry and no public exploit code identified at time of analysis, and no EPSS score was supplied, so this is best treated as a credible but conditional risk rather than a drop-everything emergency.
MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 fail to consistently write successful authentication events to the audit log, which degrades a customer's ability to detect and investigate unauthorized access or credential misuse. The exposure is limited to logging/visibility: independent assessment rates the impact as integrity-only against the audit record (C:N/I:L/A:N), and the flaw gives an attacker no access by itself - harm only materialises after a separate successful authentication with legitimate or stolen credentials. There is no public exploit identified at time of analysis, and remediation is an upgrade to 12.1.0 or 11.3.7 or later.
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 validate authentication tokens incorrectly, accepting a token the server should reject, so a remote attacker who can reach the instance can obtain unauthorized access under that token's identity. The vendor-published CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), while our independent assessment raises the confidentiality impact to High (C:H/I:H/A:N), reflecting that an improperly accepted token may expose data as well as permit modification; neither vector assesses any availability impact. No public exploit code or confirmed active exploitation was identified at time of analysis (the CVE is not in CISA KEV) and no EPSS score was available in the supplied data, so the realistic limiting factor is deployment exposure: the MarkLogic instance must be network-reachable by the attacker.
XML external entity (XXE) processing in Progress MarkLogic Server 11.x before 11.3.7 allows remote, unauthenticated attackers to disclose local files or trigger outbound network requests from the server through attacker-supplied SAML messages. Exploitation is conditional: the instance must be configured to use SAML single sign-on, since only the SAML parser's handling of external DTDs and entities is affected, and the impact is limited to confidentiality (C:H, no integrity or availability impact, CVSS 7.5). No public exploit code and no confirmed active exploitation have been identified at time of analysis, so this represents a genuine but conditional priority - patching matters most for deployments that have SAML SSO enabled and exposed to untrusted networks.
Privilege escalation in Progress MarkLogic Server affects 11.x releases before 11.3.7 and 12.x releases before 12.1.0, where an attacker who already holds an administrative account can reach authentication material belonging to higher-privileged users and use it to obtain unauthorized administrative access (CWE-269, CVSS 8.4 with scope change). Exploitation is gated by pre-existing admin privileges, so this is primarily an insider or post-compromise escalation risk rather than an externally reachable entry point; no public exploit has been identified at time of analysis and there is no CISA KEV association. No EPSS score was supplied in the available intelligence, so likelihood estimates should be treated as unquantified.
MarkLogic Server 11.x before 11.3.7 and 12.x before 12.1.0 can write security-sensitive values - information that enables access to protected resources - into diagnostic logs when the server is running in specific, non-default configurations. Anyone who can already read those logs (filesystem access, a log-aggregation/SIEM pipeline, backup or archive copies, or an account permitted to view logs) can harvest that data and use it to obtain unauthorized access, so the exposure is genuine but gated on two preconditions: a particular logging configuration must be present, and the attacker must already hold low-privileged log read access. No public exploit code or confirmed active exploitation (no CISA KEV listing) was identified at time of analysis, and the independent assessment rates this as a confidentiality-only, local-context issue (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), making it a moderate-priority hardening problem rather than an emergency despite the 8.1 vendor score.
Authenticated XQuery injection in Progress MarkLogic Server 11.x before 11.3.7 and 12.x before 12.1.0 allows a remote attacker who already holds a manage-user-level account to escalate to persistent unauthorized administrative control of the database. The flaw resides in a deprecated Management API package path and carries a 9.9 CVSS score because exploitation crosses a security boundary (S:C) and fully compromises confidentiality, integrity, and availability. It is not a pre-authentication issue - a valid manage-user credential is mandatory - and no public exploit code has been identified at time of analysis, so risk is concentrated in environments where the Management API is network-exposed and manage-user grants are loosely administered.
An authenticated privilege-escalation flaw in Progress MarkLogic Server lets an attacker who already holds forest-management privileges create a persistent, unauthorized administrator account, resulting in complete administrative control of the server. Affected are 12.x releases before 12.1.0 and 11.x releases before 11.3.7; the vulnerability is reachable over the network (AV:N) with low privileges (PR:L) and no user interaction, and it is rated 9.9 because a successful escalation changes scope, giving the attacker high confidentiality, integrity and availability impact across the deployment. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (no CISA KEV listing); the practical risk is concentrated in deployments that delegate forest-management rights to non-super-admin or duty-separated roles, since an attacker must first possess that privilege to exploit the flaw.
Insufficient isolation in Progress MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7 allows code executed through REST Client API and XDBC evaluation paths to reach the surrounding HTTP request, response, and session state, enabling unauthorized actions or compromise of an authenticated user's session. The vendor scores this 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), but the scope change and full confidentiality/integrity/availability impact only materialize when an attacker can reach an evaluation interface and a victim with an authenticated session triggers it; our assessment rates the prerequisite as authenticated (PR:L) rather than unauthenticated, so exposure is limited to deployments where these endpoints are reachable and in use. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (no CISA KEV listing) as of this report.
Server-side request forgery in Progress MarkLogic Server before 11.3.6 and 12.0.3 enables authenticated low-privileged users to bypass existing IMDS protection filters, causing the server to fetch cloud instance metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254). Successful exploitation yields temporary cloud IAM credentials, extending attacker reach to all cloud resources accessible by the host instance's IAM role. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the Scope:Changed CVSS metric and credential-theft impact elevate operational priority significantly for cloud-hosted deployments.
Stored/reflected cross-site scripting in the Query Console of Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets a remote, unauthenticated attacker execute arbitrary JavaScript in the browser of an authenticated administrator who is lured to a crafted URL. Because the payload runs with the admin's authenticated session, it can harvest credentials/session tokens and perform privileged database and configuration actions on the admin's behalf. Rated CVSS 9.3 (scope-changed); no public exploit identified at time of analysis and not listed in CISA KEV.
Privilege escalation in Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets an authenticated user holding only a low-privileged Hadoop integration role break out of that role and perform privileged operations against the internal Security database, effectively enabling full control over authentication and authorization data. Rated CVSS 9.9 with a changed scope, the flaw turns a minimal Hadoop-connector account into an administrative foothold. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in the ODBC App Server of Progress MarkLogic Server (before 11.3.6 and 12.0.3) lets an unauthenticated remote attacker circumvent password verification and run queries as any named user, including administrators. Because impersonation extends to admin-level accounts, an attacker gains full read/write control over the database and its data. No public exploit has been identified at time of analysis, but the CVSS 9.8 rating and admin-impersonation impact make this a critical, network-reachable flaw.
HTTP request smuggling in Progress MarkLogic Server's HTTP App Server (versions before 11.3.6 and 12.0.3) lets a remote attacker desynchronize request parsing between a fronting reverse proxy and MarkLogic, enabling authentication/authorization bypass, session hijacking, and credential capture. The flaw is exploitable over the network without authentication (PR:N) and carries a critical 9.1 CVSS with high confidentiality and integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; no EPSS score was supplied.
Privilege escalation in Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user holding only a low-privileged REST role to abuse the REST API document patch operation, gaining the ability to run privileged operations against the internal Security database and effectively take over authorization data. Rated CVSS 9.9 with a changed scope, it is exploitable by any low-privileged REST account over the network. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and minimal privilege requirement make it a high-priority patch.
Authentication bypass in Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets an unauthenticated remote attacker forge SAML assertions and impersonate any user, including administrators, on deployments where SAML single sign-on is enabled. The flaw stems from improper cryptographic signature verification (CWE-347) in the SAML authentication module, yielding full identity spoofing over the network with low complexity and no user interaction. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV, but the 9.1 CVSS and pre-authentication admin impersonation make it a high-priority patch.
Privilege escalation in Progress MarkLogic Server before 11.3.6 and 12.0.3 lets an authenticated user holding only a low-privileged REST role elevate to administrator through the SQL, SPARQL, and Optic REST query interfaces, after which they can run privileged operations and read data they were never authorized to see. The flaw is remotely reachable and requires only valid low-tier credentials, driving a critical 9.9 CVSS score. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation in Progress MarkLogic Server's REST API document processing pipeline allows an authenticated user holding an administrative REST role to elevate their access to a higher privilege level, resulting in unauthorized disclosure of sensitive server-side data. Affected versions span both the 11.x and 12.x release trains, patched in 11.3.6 and 12.0.3 respectively per the vendor's August 2026 critical security bulletin. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, though the scope change (S:C) and high confidentiality and integrity impact in the CVSS vector underscore meaningful post-exploitation consequence within the MarkLogic environment.
Cross-site request forgery in the Progress MarkLogic Server Admin UI allows a remote attacker to perform privileged administrative actions on behalf of a logged-in administrator by luring them to a crafted malicious webpage. Affected versions span the 11.x line prior to 11.3.6 and the 12.x line prior to 12.0.3, covering deployments across both active release trains. No public exploit code or active exploitation has been identified; Progress Software has issued patches for both branches.
HTTP response splitting in Progress MarkLogic Server affects the Query Console file-exploration endpoint in 12.x releases before 12.1.0 and 11.x releases before 11.3.7, where insufficient input sanitization permits CR/LF injection into generated HTTP responses. Exploitation requires an authenticated Query Console session (CVSS PR:L) and a victim to trigger the attacker-influenced request (UI:R), so it is not a fully automated remote attack; the impact is a scope-changed, low-severity client-side response manipulation with limited confidentiality and integrity effects and no availability impact, consistent with a CVSS 3.1 base score of 5.4. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied with the source data.
Cross-site scripting in Progress MarkLogic Server lets a remote, unauthenticated attacker execute arbitrary script in the browser of an authenticated MarkLogic user - typically an administrator or developer working in the web-based Admin or Query console - after that user clicks a crafted link or loads attacker-supplied content. Only 12.x releases before 12.1.0 and 11.x releases before 11.3.7 are affected; the flaw is rated CVSS 3.1 base 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), with the required victim interaction and the need for an existing authenticated session being the main limiting factors. Successful exploitation could drive unauthorized actions or expose information accessible to that authenticated user, and no public exploit code has been identified at time of analysis.