These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A vulnerability in Progress MarkLogic Server Query Console allows for HTTP response splitting due to insufficient input sanitization. This issue affects MarkLogic Server 11.x versions prior to 11.3.7 and 12.x versions prior to 12.1.0. The vulnerability can lead to unintended client-side response handling, potentially impacting data integrity and confidentiality. Defenders should assess exposure and priori [truncated]
Progress MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7 may use cleartext transport for Amazon S3 connections by default. This vulnerability allows a network-positioned attacker to intercept data or credentials, potentially leading to unauthorized access or eavesdropping. Defenders should assess exposure and prioritize remediation to prevent exploitation. The affected instances require verific [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-10-12T16:50:49.589Z and has not been modified since then. Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently validate TLS certificate hostnames for certain outbound connections. A network-positioned attacker could exploit this weakness to intercept [truncated]
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 have an improper Kerberos server verification vulnerability. This issue allows a network-positioned attacker to impersonate trusted authentication infrastructure, potentially resulting in unauthorized access or modification of protected data. The vulnerability arises from insufficient verification of the Kerberos authent [truncated]
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 have overly permissive operating-system permissions on certain log files. This vulnerability, CVE-2026-85971, allows local users to potentially read or alter log data. Defenders responsible for Progress MarkLogic Server deployments, especially those with local user access, should assess exposure and prioritize remediatio [truncated]
CVE-2026-85970 debrief based on CVE Program and NVD records. Progress MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7 have improper XML external entity restriction, potentially allowing crafted XML to cause server-side requests or local file disclosure. The vulnerability enables XML external entity processing by default in multiple server paths. Defenders should assess exposure and apply patche [truncated]
CVE-2026-85969 is an out-of-bounds write vulnerability in Progress MarkLogic Server. Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 are affected. A remote authenticated attacker could exploit this vulnerability to cause server instability or limited modification of data. The vulnerability is located in certain language-processing functionality. Defenders should asses [truncated]
CVE-2026-85968 is an out-of-bounds read vulnerability in Progress MarkLogic Server 12.x releases before 12.1.0. A remote authenticated attacker could exploit this vulnerability to cause server instability or disclose limited information from process memory. This issue affects MarkLogic Server deployments, particularly those using versions 12.0.0 and prior. Defenders should assess exposure and potential im [truncated]
A cross-site scripting vulnerability exists in Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7. This vulnerability could allow a remote attacker to execute script in the context of an authenticated user's browser session, potentially resulting in unauthorized actions or disclosure of information accessible to that user.
CVE-2026-85966 debrief based on the supplied source corpus. The CVE record was published on 2026-10-12T16:31:32.011Z and has not been modified since then. Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently restrict access to certain security-sensitive information. A remote authenticated attacker with limited management permissions could obtain this in [truncated]
Progress MarkLogic Server contains a use-after-free vulnerability in its JavaScript engine integration, potentially leading to memory corruption, controlled process failure, or server instability. This issue affects MarkLogic Server 11.x versions before 11.3.7 and 12.x versions before 12.1.0. The vulnerability could result in memory corruption, controlled process failure, or server instability. Defenders [truncated]
Progress MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7 allow authenticated Query Console users to supply unsafe path values, potentially disclosing arbitrary server files. Defenders should assess exposure, prioritize remediation, and verify affected versions. The vulnerability is a path traversal issue in the Query Console, which could lead to unauthorized access to sensitive files. It is ess [truncated]
A server-side request forgery and hard-coded key vulnerability exists in Progress MarkLogic Server OpsDirector. Affected versions include 11.x releases before 11.3.7 and 12.x releases before 12.1.0. This weakness could allow an unauthenticated remote attacker to make unauthorized requests to internal services or forge trusted requests, potentially resulting in unauthorized access to protected information.
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an improper authentication vulnerability in SAML processing. This could allow an unauthenticated remote attacker to cause the server to accept a rejected assertion, potentially leading to unauthorized access. The vulnerability has a high severity score of 7.5 and affects deployments that use SAML authentication. [truncated]
Progress MarkLogic Server Azure deployments may record security-sensitive authentication information in diagnostic logs under certain configurations. An attacker with access to these logs could use this information to gain unauthorized access to protected cloud resources. This exposure may lead to lateral movement within cloud environments if logs are accessed by unauthorized parties. Defenders should ver [truncated]
A cross-site request forgery vulnerability exists in Progress MarkLogic Server Query Console, allowing remote attackers to submit unauthorized requests and execute server-side code with victim's permissions. This vulnerability affects Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7. Defenders should assess exposure and prioritize patching or mitigation to prevent pote [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently record successful authentication events in audit logs. This insufficient authentication logging could limit customers' ability to detect and investigate unauthorized access or credential misuse. The CVE record was published on 2026-10 [truncated]
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authentication validation weakness that could allow an attacker to use a token that should not be accepted by the affected server, potentially resulting in unauthorized access. This weakness affects Progress MarkLogic Server deployments, particularly those using 11.x and 12.x releases. Defenders should assess [truncated]
CVE-2026-85957 debrief based on the supplied source corpus. The CVE record was published on 2026-10-12T16:01:34.049Z and has not been modified since then. Affected Progress MarkLogic Server 11.x releases before 11.3.7 use a SAML parser configuration that can process external DTDs or entities, potentially resulting in unintended network access or information disclosure. Defenders responsible for Progress M [truncated]
A critical vulnerability in Progress MarkLogic Server allows unauthorized backup and restore operations, potentially leading to security-critical data exposure or modification. This issue arises from improper privilege management, enabling remote attackers with delegated database-administrator privileges to perform operations on forests outside the authorized database scope. Progress MarkLogic Server admi [truncated]
A critical vulnerability in Progress MarkLogic Server allows remote attackers with query-execution access to invoke an XQuery evaluation function without required privileges, potentially leading to server-side code execution with elevated permissions. This issue affects MarkLogic Server versions 11.x before 11.3.7 and 12.x before 12.1.0. The vulnerability, known as CVE-2026-85955, is an improper privilege [truncated]
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 are vulnerable to improper privilege management in certain higher-order XQuery functions. This could allow an attacker to escalate privileges beyond their granted permissions. The vulnerability is located in the higher-order XQuery functions, which can evaluate user-controlled values in an elevated security context. Affe [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-10-12T15:58:02.995Z and has not been modified since then. Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain privileged legacy InfoStudio modules that do not sufficiently validate user-controlled file paths and user-context values. This could result in unautho [truncated]
A server-side request forgery vulnerability exists in Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7. This could allow an authenticated attacker to access internal cloud services and potentially expose cloud credentials. The vulnerability affects Linux-based deployments, and defenders should assess their exposure and prioritize verification and mitigation efforts. Th [truncated]
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 on Azure contain a server-side request forgery vulnerability. An authenticated attacker could exploit this to access internal cloud services, potentially leading to unauthorized access to cloud credentials or tokens. The vulnerability is particularly concerning for defenders responsible for Progress MarkLogic Server inst [truncated]
CVE-2026-85950 debrief based on the supplied source corpus. The CVE record was published on 2026-10-12T15:42:22.190Z and has not been modified since then. Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw that could allow a remote attacker with administrative privileges to access authentication material associated with higher-privileged use [truncated]
Progress MarkLogic Server releases before 12.1.0 and 11.x before 11.3.7 may log security-sensitive information under certain configurations. Attackers with access to these logs could use this information to gain unauthorized access to protected resources. This vulnerability involves sensitive information exposure in diagnostic logs, potentially leading to unauthorized access if logs are exposed. Defenders [truncated]
A critical vulnerability exists in Progress MarkLogic Server versions 11.x before 11.3.7 and 12.x before 12.1.0. An XQuery injection flaw in a deprecated Management API package path allows remote attackers with manage-user-level privileges to gain persistent unauthorized administrative control. Defenders should assess exposure, prioritize remediation, and verify affected versions.
A critical vulnerability exists in Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7, allowing a remote attacker with forest-management privileges to create a persistent unauthorized administrator account. This could result in complete unauthorized administrative control of the server. The vulnerability is highly severe, with a CVSS score of 9.9, and defenders should as [truncated]
CVE-2026-9191: Insufficient isolation of user-supplied code in Progress MarkLogic Server. Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently isolate user-supplied code executed through certain REST and XDBC evaluation paths from HTTP request, response, and session state. An attacker able to execute code through an affected path could perform unauthori [truncated]
