CVE-2026-85966: Exposure of sensitive information in Progress MarkLogic Server
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently restrict access to certain security-sensitive information. A remote authenticated attacker with limited management permissions could obtain this information, which could result in unauthorized access to protected resources.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress MarkLogic Serverto a version that resolves this vulnerability.Fixed in 12.1.0 - Upgrade
Upgrade
Progress MarkLogic Serverto a version that resolves this vulnerability.Fixed in 11.3.7
Event History
Frequently Asked Questions
Which deployments are affected?
Affected releases are Progress MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7.
What level of access does an attacker need?
An attacker must be remote, authenticated, and have limited management permissions. No user interaction is required.
What could an attacker achieve?
The attacker could obtain certain security-sensitive information, potentially enabling unauthorized access to protected resources.