PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-85957 Progress Software Corporation CVE debrief

CVE-2026-85957 debrief based on the supplied source corpus. The CVE record was published on 2026-10-12T16:01:34.049Z and has not been modified since then. Affected Progress MarkLogic Server 11.x releases before 11.3.7 use a SAML parser configuration that can process external DTDs or entities, potentially resulting in unintended network access or information disclosure. Defenders responsible for Progress MarkLogic Server 11.x deployments should assess exposure and prioritize remediation for affected versions.

Vendor
Progress Software Corporation
Product
MarkLogic Server
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-12
Original CVE updated
2026-10-12
Advisory published
2026-10-12
Advisory updated
2026-10-12

Who should care

Defenders responsible for Progress MarkLogic Server 11.x deployments should assess exposure and prioritize remediation for affected versions.

Why it matters

CVE-2026-85957 requires verification of affected Progress MarkLogic Server 11.x releases before 11.3.7 and prompt remediation to prevent potential network access or information disclosure.

  • Potential unintended network access
  • Potential information disclosure
  • Verification of affected versions required
  • Remediation priority for Progress MarkLogic Server 11.x releases before 11.3.7

Technical summary

Progress MarkLogic Server 11.x releases before 11.3.7 use a SAML parser configuration that can process external DTDs or entities, potentially resulting in unintended network access or information disclosure. This vulnerability requires verification of affected Progress MarkLogic Server 11.x releases before 11.3.7 and prompt remediation to prevent potential network access or information disclosure.

Defensive priority

Defenders should prioritize verifying affected Progress MarkLogic Server 11.x releases before 11.3.7 and applying vendor-provided remediation.

Recommended defensive actions

  • Verify Progress MarkLogic Server 11.x releases before 11.3.7 for potential vulnerability
  • Apply vendor-provided remediation for affected versions
  • Monitor for potential network access or information disclosure

Evidence notes

The CVE record and source item provide limited information about the vulnerability, including its description and affected versions. The source item and CVE Program record indicate that Progress MarkLogic Server 11.x releases before 11.3.7 are affected. However, additional verification is required to confirm the scope of the vulnerability and potential impacts. Defenders should verify affected versions and apply vendor-provided remediation.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-85957 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-85957

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-85957 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-85957

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.