CVE-2026-85952 Progress Software Corporation CVE debrief

Who should care

Defenders responsible for Linux-based Progress MarkLogic Server deployments, especially those in cloud environments, should assess their exposure to this vulnerability and prioritize verification and mitigation efforts.

Why it matters

This server-side request forgery vulnerability in Progress MarkLogic Server could allow authenticated attackers to access internal cloud services and potentially expose cloud credentials, requiring defenders to verify exposure, assess impact, and prioritize mitigation.

• Potential unauthorized access to internal cloud services.
• Possible exposure of cloud credentials.
• Need for verification of affected versions in use.
• Priority on implementing recommended patches or mitigations.

Technical summary

The Progress MarkLogic Server is vulnerable to server-side request forgery (SSRF) in Linux-based deployments. This vulnerability, affecting versions 11.x before 11.3.7 and 12.x before 12.1.0, could allow an authenticated attacker to access internal cloud services, potentially resulting in unauthorized access to cloud credentials. The vulnerability requires defenders to verify exposure, assess impact, and prioritize mitigation. The CVE record and source item provide details on the vulnerability and affected versions, but additional information on exploitation or specific defensive measures is limited.

Defensive priority

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their Linux-based Progress MarkLogic Server deployments, especially those in cloud environments.

Recommended defensive actions

• Verify if your Linux-based Progress MarkLogic Server deployment is using an affected version (11.x before 11.3.7 or 12.x before 12.1.0).
• Assess the potential impact of this vulnerability on your cloud services and credentials.
• Review and implement recommended mitigations or patches from Progress Software Corporation.
• Monitor your deployment for suspicious activity related to this vulnerability.
• Perform a thorough review of your cloud services and credentials to identify potential exposure.
• Implement compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions and retest remediated assets to ensure the vulnerability is fully resolved.

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and potential impact. However, additional information on exploitation, victims, or specific defensive measures is limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.