CVE-2026-85949 Progress Software Corporation CVE debrief

Who should care

Defenders responsible for Progress MarkLogic Server configurations and security should assess exposure and prioritize log security, especially in configurations handling sensitive data. Roles responsible for MarkLogic Server configurations and security should review and secure log configurations, and update to recommended versions.

Why it matters

Defenders should care about CVE-2026-85949 because it involves sensitive information exposure in Progress MarkLogic Server trace logs. Roles responsible for MarkLogic Server configurations and security should assess exposure, especially in configurations handling sensitive data. The vulnerability could lead to potential unauthorized access to protected resources if logs are exposed. Defenders should verify and secure log configurations, and update to the recommended versions.

• Potential unauthorized access to protected resources through log exposure
• Need to verify and secure MarkLogic Server log configurations
• Possible impact on data confidentiality and integrity

Technical summary

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive information in diagnostic logs under certain configurations. An attacker with access to the affected logs could use this information to obtain unauthorized access to protected resources. This vulnerability involves sensitive information exposure in diagnostic logs, potentially leading to unauthorized access if logs are exposed. Defenders should assess exposure and prioritize log security, especially in configurations handling sensitive data.

Defensive priority

Defenders should prioritize verifying and securing access to MarkLogic Server logs, especially in configurations handling sensitive data.

Recommended defensive actions

• Verify and secure access to MarkLogic Server logs
• Review configurations for sensitive data handling
• Update to version 12.1.0 or later for 12.x releases, or 11.3.7 or later for 11.x releases
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability in Progress MarkLogic Server. The vendor has released an advisory for this issue. Evidence is limited to CVE and source-item details. Defenders should verify log configurations and update to recommended versions. Additional verification is required to confirm affected scope and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.