CVE-2026-85970: Improper XML external entity restriction in Progress MarkLogic Server
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 enable XML external entity processing by default in multiple server paths, which could allow crafted XML to cause server-side requests or disclosure of local files.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress MarkLogic Serverto a version that resolves this vulnerability.Fixed in 12.1.0 - Upgrade
Upgrade
Progress MarkLogic Serverto a version that resolves this vulnerability.Fixed in 11.3.7
Event History
Frequently Asked Questions
Which deployments require remediation?
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 are affected. Upgrade to 12.1.0 or later in the 12.x line, or 11.3.7 or later in the 11.x line.
Does exploitation require authentication or user interaction?
The supplied CVSS vector indicates network reachability, low privileges required, and no user interaction. An attacker would need to submit crafted XML to one of the affected server paths.
Is a non-default configuration required for exposure?
No. XML external entity processing is enabled by default in multiple server paths on affected releases.