CVE-2026-85957: Improper XML external entity restriction in Progress MarkLogic Server SAML processing

Q: Which deployments are affected?

Progress MarkLogic Server 11.x releases before 11.3.7 are affected. The issue is in SAML processing that uses a parser configuration capable of processing external DTDs or entities.

Q: Does exploitation require authentication or user interaction?

No. The supplied CVSS vector indicates network attackability with low complexity, no privileges required, and no user interaction required.

Q: What could an attacker achieve?

Processing external DTDs or entities could cause unintended network access or information disclosure. The supplied impact data indicates high confidentiality impact, with no integrity or availability impact listed.

Published Oct 12, 2026

Updated

Affected Progress MarkLogic Server 11.x releases before 11.3.7 use a SAML parser configuration that can process external DTDs or entities, which could result in unintended network access or information disclosure.

Affected Software

1 affected component

Progress MarkLogic Server<11.3.7

Event History

Oct 12, 2026

CVE Published

via MITRE·04:01 PM

Data Sourced

via MITRE·04:01 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Progress MarkLogic Server 11.x releases before 11.3.7 are affected. The issue is in SAML processing that uses a parser configuration capable of processing external DTDs or entities.

Does exploitation require authentication or user interaction?

No. The supplied CVSS vector indicates network attackability with low complexity, no privileges required, and no user interaction required.

What could an attacker achieve?

Processing external DTDs or entities could cause unintended network access or information disclosure. The supplied impact data indicates high confidentiality impact, with no integrity or availability impact listed.

CVE-2026-85957: Improper XML external entity restriction in Progress MarkLogic Server SAML processing

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

Does exploitation require authentication or user interaction?

What could an attacker achieve?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

Does exploitation require authentication or user interaction?

What could an attacker achieve?