CVE-2026-85963: Server-side request forgery and hard-coded key in Progress MarkLogic Server OpsDirector
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 include deprecated OpsDirector functionality with weaknesses that could allow an unauthenticated remote attacker to make unauthorized requests to internal services or forge trusted requests, potentially resulting in unauthorized access to protected information.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress MarkLogic Serverto a version that resolves this vulnerability.Fixed in 12.1.0 - Upgrade
Upgrade
Progress MarkLogic Serverto a version that resolves this vulnerability.Fixed in 11.3.7
Event History
Frequently Asked Questions
Which deployments are affected?
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 are affected. The issue is associated with deprecated OpsDirector functionality included in those releases.
Does exploitation require an account or user interaction?
No. The reported attack vector is network-accessible, with low attack complexity, no privileges required, and no user interaction required.
What remediation versions address this issue?
Upgrade MarkLogic Server 12.x to 12.1.0 or later, or 11.x to 11.3.7 or later. The provided information does not identify a workaround for environments that cannot patch immediately.
How can I determine whether I may be affected?
Check the deployed MarkLogic Server version. Instances running a 12.x release earlier than 12.1.0 or an 11.x release earlier than 11.3.7 should be treated as affected.