CVE-2026-85963 Progress Software Corporation CVE debrief

Who should care

Defenders responsible for MarkLogic Server instances, especially those using OpsDirector, should assess exposure and prioritize verification and remediation efforts. This includes operators managing affected versions (11.x before 11.3.7 and 12.x before 12.1.0), vulnerability management teams, and security teams overseeing system updates and compensating controls.

Why it matters

Defenders should care about CVE-2026-85963 because it allows unauthorized requests to internal services or forged trusted requests in Progress MarkLogic Server OpsDirector, potentially leading to access to protected information. Roles responsible for MarkLogic Server instances, especially those using OpsDirector, should assess exposure and prioritize verification and remediation efforts.

• Potential unauthorized access to protected information
• Need for verification of MarkLogic Server version and exposure
• Prioritization of updates or compensating controls
• Monitoring for suspicious activity in OpsDirector

Technical summary

The vulnerability exists in the OpsDirector functionality of Progress MarkLogic Server, specifically in versions 11.x before 11.3.7 and 12.x before 12.1.0. It allows an unauthenticated remote attacker to make unauthorized requests to internal services or forge trusted requests, potentially resulting in unauthorized access to protected information. The weakness could enable attackers to access protected information without authentication, emphasizing the need for defenders to verify exposure and prioritize remediation efforts.

Defensive priority

Defenders should prioritize verifying exposure in their MarkLogic Server instances, especially those using OpsDirector, and assess the need for updates or compensating controls.

Recommended defensive actions

• Verify MarkLogic Server version and assess exposure
• Review and apply vendor-provided updates or patches
• Implement compensating controls to restrict unauthorized requests
• Monitor for suspicious activity in OpsDirector
• Review system logs for signs of potential exploitation
• Conduct a thorough risk assessment for affected systems
• Prioritize updates or compensating controls for exposed systems

Evidence notes

The CVE record and source item provide details on the vulnerability and affected versions. However, additional information on exploitation or impact is limited. Defenders should verify the affected versions (11.x before 11.3.7 and 12.x before 12.1.0) and assess exposure. Limited evidence suggests that an unauthenticated remote attacker could make unauthorized requests to internal services or forge trusted requests, potentially resulting in unauthorized access to protected information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.