CVE-2026-85957: Improper XML external entity restriction in Progress MarkLogic Server SAML processing
Published Oct 12, 2026
·Updated
Affected Progress MarkLogic Server 11.x releases before 11.3.7 use a SAML parser configuration that can process external DTDs or entities, which could result in unintended network access or information disclosure.
Affected Software
1 affected component
Progress MarkLogic Server<11.3.7
Event History
Oct 12, 2026
CVE Published
via MITRE·04:01 PM
Data Sourced
via MITRE·04:01 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
Progress MarkLogic Server 11.x releases before 11.3.7 are affected. The issue is in SAML processing that uses a parser configuration capable of processing external DTDs or entities.
2
Does exploitation require authentication or user interaction?
No. The supplied CVSS vector indicates network attackability with low complexity, no privileges required, and no user interaction required.
3
What could an attacker achieve?
Processing external DTDs or entities could cause unintended network access or information disclosure. The supplied impact data indicates high confidentiality impact, with no integrity or availability impact listed.