CVE-2026-7329: Privilege escalation in Progress MarkLogic Server REST query interfaces

Published Aug 5, 2026

Updated

An improper privilege management vulnerability in the SQL, SPARQL, and Optic REST query interfaces of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges to administrator. This enables execution of privileged operations and unauthorized data access.

Affected Software

1 affected component

Progress MarkLogic Server<11.3.6, >11.3.6<=12.0.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Progress MarkLogic Server to a version that resolves this vulnerability.
Fixed in 11.3.6
Upgrade
Upgrade Progress MarkLogic Server to a version that resolves this vulnerability.
Fixed in 12.0.3

Event History

Aug 5, 2026

CVE Published

via MITRE·03:32 PM

Data Sourced

via MITRE·03:32 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-7329?

CVE-2026-7329 has a critical severity rating of 9.9.

What types of operations can be executed through the CVE-2026-7329 vulnerability?

Through CVE-2026-7329, an authenticated low-privileged user can escalate privileges to execute privileged operations.

Which versions of Progress MarkLogic Server are affected by CVE-2026-7329?

CVE-2026-7329 affects Progress MarkLogic Server versions prior to 11.3.6 and 12.0.3.

How can I mitigate the risk associated with CVE-2026-7329?

To mitigate the risk of CVE-2026-7329, upgrade to Progress MarkLogic Server version 11.3.6 or 12.0.3 or later.

Is it necessary for an attacker to be authenticated to exploit CVE-2026-7329?

Yes, an attacker needs to be an authenticated user with a low-privileged REST role to exploit CVE-2026-7329.

CVE-2026-7329: Privilege escalation in Progress MarkLogic Server REST query interfaces

Affected Software

Remediation

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2026-7329?

What types of operations can be executed through the CVE-2026-7329 vulnerability?

Which versions of Progress MarkLogic Server are affected by CVE-2026-7329?

How can I mitigate the risk associated with CVE-2026-7329?

Is it necessary for an attacker to be authenticated to exploit CVE-2026-7329?

Company

Resources

Contact

Frequently Asked Questions

What is the severity of CVE-2026-7329?

What types of operations can be executed through the CVE-2026-7329 vulnerability?

Which versions of Progress MarkLogic Server are affected by CVE-2026-7329?

How can I mitigate the risk associated with CVE-2026-7329?

Is it necessary for an attacker to be authenticated to exploit CVE-2026-7329?