CVE-2026-85970 Progress Software Corporation CVE debrief

Who should care

Defenders managing Progress MarkLogic Server instances, particularly those using 11.x and 12.x releases, should assess exposure and apply patches to prevent potential server-side requests or local file disclosure.

Why it matters

CVE-2026-85970 requires verification of Progress MarkLogic Server exposure, particularly for 11.x and 12.x releases, and prompt application of patches to prevent potential server-side requests or local file disclosure.

• Potential server-side request forgery
• Possible local file disclosure
• Need for inventory checks and patch verification
• Monitoring for suspicious XML processing activity

Technical summary

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 enable XML external entity processing by default, potentially allowing crafted XML to cause server-side requests or disclosure of local files. This vulnerability requires defenders to verify exposure and apply patches to prevent potential server-side requests or local file disclosure. The vulnerability has been publicly disclosed and requires immediate attention from defenders. There is no evidence of public exploitation, but defenders should verify exposure and apply patches.

Defensive priority

Defenders should prioritize verifying exposure and applying vendor patches, focusing on MarkLogic Server inventory and monitoring for suspicious XML processing activity.

Recommended defensive actions

• Verify MarkLogic Server version and apply patches for 11.x and 12.x releases
• Monitor XML processing activity for suspicious requests
• Review server configurations for XML external entity processing
• Conduct an inventory of MarkLogic Server instances to identify potential exposure
• Prioritize patching based on business criticality and potential impact
• Implement compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE Program and NVD records provide details on the vulnerability in Progress MarkLogic Server. Vendor advisory information is available but limited. The vulnerability has been publicly disclosed and requires immediate attention from defenders. There is no evidence of public exploitation, but defenders should verify exposure and apply patches. The CVE record was published on 2026-10-12T16:39:27.145Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.