CVE-2026-85962 Progress Software Corporation CVE debrief

Who should care

Defenders responsible for Progress MarkLogic Server deployments using SAML authentication should assess exposure and prioritize updates and monitoring. This includes operators, security teams, and vulnerability management teams. They should verify and update Progress MarkLogic Server instances to the latest versions, review SAML authentication configurations, and monitor for suspicious activity.

Why it matters

CVE-2026-85962 is a high-severity vulnerability in Progress MarkLogic Server that could allow unauthorized access. Defenders should prioritize updates, review SAML configurations, and monitor for suspicious activity.

• Potential unauthorized access to Progress MarkLogic Server instances.
• Need to verify and update Progress MarkLogic Server versions to prevent exploitation.
• Requires review of SAML authentication configurations to ensure proper setup.

Technical summary

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an improper authentication vulnerability in SAML processing. An unauthenticated remote attacker could cause the affected server to accept an assertion that should be rejected, potentially resulting in unauthorized access. The vulnerability has a high severity score of 7.5 and affects deployments that use SAML authentication. Defenders should prioritize verifying and updating Progress MarkLogic Server instances to the latest versions, reviewing SAML authentication configurations, and monitoring for suspicious activity.

Defensive priority

Defenders should prioritize verifying and updating Progress MarkLogic Server instances to the latest versions, reviewing SAML authentication configurations, and monitoring for suspicious activity.

Recommended defensive actions

• Verify Progress MarkLogic Server version and update to 12.1.0 or later for 12.x releases, or 11.3.7 or later for 11.x releases.
• Review SAML authentication configurations and ensure proper setup.
• Monitor for suspicious activity and implement additional security measures as needed.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE Program and NVD records provide details on the vulnerability, affected versions, and potential impact. However, additional information on exploitation or specific attacks is not available. The vulnerability is confirmed to exist in Progress MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7. Defenders should verify and update Progress MarkLogic Server instances to the latest versions and review SAML authentication configurations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.