CVE-2026-85959: Insufficient authentication logging in Progress MarkLogic Server
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently record successful authentication events in audit logs, which could limit customers' ability to detect and investigate unauthorized access or credential misuse.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress MarkLogic Serverto a version that resolves this vulnerability.Fixed in 12.1.0 - Upgrade
Upgrade
Progress MarkLogic Serverto a version that resolves this vulnerability.Fixed in 11.3.7
Event History
Frequently Asked Questions
Which releases need to be remediated?
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 are affected. Upgrade to 12.1.0 or later in the 12.x line, or 11.3.7 or later in the 11.x line.
What is the practical security impact?
Successful authentication events may not be consistently recorded in audit logs. This can prevent customers from detecting or investigating unauthorized access or credential misuse.
Can existing audit logs be used to rule out unauthorized access?
No. Because successful authentication events may be absent from affected systems' audit logs, missing authentication records cannot be treated as evidence that no access occurred.