CVE-2026-85958: Improper OAuth token validation in Progress MarkLogic Server

Q: What does an attacker need to exploit this issue?

The issue is remotely exploitable with low attack complexity and requires no privileges or user interaction. Exploitation involves presenting a token that the affected server should reject.

Q: What is the impact of successful exploitation?

A successful attacker could gain unauthorized access. The provided vector identifies integrity impact, with no stated confidentiality or availability impact.

Q: What should be prioritized for remediation?

Upgrade affected 12.x deployments to 12.1.0 or later and affected 11.x deployments to 11.3.7 or later.

Published Oct 12, 2026

Updated

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authentication validation weakness that could allow an attacker to use a token that should not be accepted by the affected server, which could result in unauthorized access.

Affected Software

1 affected component

Progress MarkLogic Server<12.1.0, <11.3.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Progress MarkLogic Server 12.x to a version that resolves this vulnerability.
Fixed in 12.1.0
Upgrade
Upgrade Progress MarkLogic Server 11.x to a version that resolves this vulnerability.
Fixed in 11.3.7

Event History

Oct 12, 2026

CVE Published

via MITRE·04:02 PM

Data Sourced

via MITRE·04:02 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 are affected.

What does an attacker need to exploit this issue?

The issue is remotely exploitable with low attack complexity and requires no privileges or user interaction. Exploitation involves presenting a token that the affected server should reject.

What is the impact of successful exploitation?

A successful attacker could gain unauthorized access. The provided vector identifies integrity impact, with no stated confidentiality or availability impact.

What should be prioritized for remediation?

Upgrade affected 12.x deployments to 12.1.0 or later and affected 11.x deployments to 11.3.7 or later.

CVE-2026-85958: Improper OAuth token validation in Progress MarkLogic Server

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What is the impact of successful exploitation?

What should be prioritized for remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What is the impact of successful exploitation?

What should be prioritized for remediation?