CVE-2026-85967 Progress Software Corporation CVE debrief

Who should care

Defenders responsible for MarkLogic Server instances, especially those with user authentication, should assess exposure and prioritize remediation efforts. They should verify the exposure of MarkLogic Server instances, especially those with user authentication, and assess the potential for script injection attacks. Remediation efforts should focus on upgrading to patched versions 11.3.7 or 12.1.0.

Why it matters

Defenders should prioritize verifying exposure of MarkLogic Server instances, especially those with user authentication, and assess the potential for script injection attacks. Remediation efforts should focus on upgrading to patched versions 11.3.7 or 12.1.0.

• Potential for script injection attacks
• Unauthorized actions or disclosure of information
• Need for verification of exposure and remediation
• Potential impact on user sessions

Technical summary

The vulnerability exists in Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7. A remote attacker could exploit this vulnerability to execute script in the context of an authenticated user's browser session, potentially resulting in unauthorized actions or disclosure of information accessible to that user. This vulnerability could allow a remote attacker to execute script in the context of an authenticated user's browser session, potentially resulting in unauthorized actions or disclosure of information accessible to that user. Defenders should prioritize verifying exposure of MarkLogic Server instances, especially those with user authentication, and assess the potential for

Defensive priority

Defenders should prioritize verifying exposure of MarkLogic Server instances, especially those with user authentication, and assess the potential for script injection attacks. Remediation efforts should focus on upgrading to patched versions 11.3.7 or 12.1.0.

Recommended defensive actions

• Verify exposure of MarkLogic Server instances, especially those with user authentication
• Assess the potential for script injection attacks
• Upgrade to patched versions 11.3.7 or 12.1.0
• Monitor for suspicious user session activity
• Implement additional security measures to prevent script injection

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and potential impacts. However, there is limited information on exploitation or specific attacks. Defenders should verify the exposure of MarkLogic Server instances, especially those with user authentication, and assess the potential for script injection attacks. The vendor advisory and CVE Program record provide additional context on the vulnerability and recommended actions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.