MarkLogic Server vulnerabilities | LiveThreat CVE Feed

Product

MarkLogic Server

by Progress Software Corporation · last CVE Oct 12, 2026

CVEs

On KEV

9.9

Max CVSS

New 30D

Vulnerabilities41 In the news0 Timeline

Severity mix

Critical 12High 27Medium 2Low 0

Severity

All severities41 Critical12 High27 Medium2 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add MarkLogic Server to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-7326	8.8	0%	Aug 5	Cross-site request forgery in Progress MarkLogic Server Admin UI Affected: 11.0.0 before 11.3.6; 12.0.0 before 12.0.3
CVE-2026-85954	8.6	0%	Oct 12	Improper privilege management in Progress MarkLogic Server higher-order XQuery functions Affected: 11.0.0 before 11.3.7; 12.0.0 before 12.1.0
CVE-2026-85953	8.5	0%	Oct 12	Path traversal and privilege management flaws in Progress MarkLogic Server InfoStudio Affected: 11.0.0 before 11.3.7; 12.0.0 before 12.1.0
CVE-2026-85952	8.5	0%	Oct 12	Server-side request forgery in Progress MarkLogic Server Linux cloud deployments Affected: 11.0.0 before 11.3.7; 12.0.0 before 12.1.0
CVE-2026-85951	8.5	0%	Oct 12	Server-side request forgery in Progress MarkLogic Server Azure deployments Affected: 11.0.0 before 11.3.7; 12.0.0 before 12.1.0
CVE-2026-9203	8.5	0%	Aug 5	Server-side request forgery in Progress MarkLogic Server Affected: 11.0.0 before 11.3.6; 12.0.0 before 12.0.3
CVE-2026-85950	8.4	0%	Oct 12	Improper privilege management in Progress MarkLogic Server REST extensions Affected: 11.0.0 before 11.3.7; 12.0.0 before 12.1.0
CVE-2026-85949	8.1	0%	Oct 12	Sensitive information exposure in Progress MarkLogic Server trace logs Affected: 11.0.0 before 11.3.7; 12.0.0 before 12.1.0
CVE-2026-7327	8.1	0%	Aug 5	Privilege escalation in Progress MarkLogic Server REST API document processing Affected: 11.0.0 before 11.3.6; 12.0.0 before 12.0.3
CVE-2026-85965	8.0	0%	Oct 12	Use-after-free in Progress MarkLogic Server JavaScript engine integration Affected: 11.0.0 before 11.3.7; 12.0.0 before 12.1.0
CVE-2026-85966	7.7	0%	Oct 12	Exposure of sensitive information in Progress MarkLogic Server Affected: 11.0.0 before 11.3.7; 12.0.0 before 12.1.0
CVE-2026-85964	7.7	0%	Oct 12	Path traversal in Progress MarkLogic Server Query Console Affected: 11.0.0 before 11.3.7; 12.0.0 before 12.1.0
CVE-2026-85975	7.5	0%	Oct 12	Cleartext transmission in Progress MarkLogic Server Amazon S3 connections Affected: 11.0.0 before 11.3.7; 12.0.0 before 12.1.0
CVE-2026-85963	7.5	0%	Oct 12	Server-side request forgery and hard-coded key in Progress MarkLogic Server OpsDirector Affected: 11.0.0 before 11.3.7; 12.0.0 before 12.1.0
CVE-2026-85962	7.5	0%	Oct 12	Improper authentication in Progress MarkLogic Server SAML processing Affected: 11.0.0 before 11.3.7; 12.0.0 before 12.1.0
CVE-2026-85961	7.5	0%	Oct 12	Sensitive information exposure in Progress MarkLogic Server Azure deployments Affected: 11.0.0 before 11.3.7; 12.0.0 before 12.1.0
CVE-2026-85960	7.5	0%	Oct 12	Cross-site request forgery in Progress MarkLogic Server Query Console Affected: 11.0.0 before 11.3.7; 12.0.0 before 12.1.0
CVE-2026-85959	7.5	0%	Oct 12	Insufficient authentication logging in Progress MarkLogic Server Affected: 11.0.0 before 11.3.7; 12.0.0 before 12.1.0
CVE-2026-85958	7.5	0%	Oct 12	Improper OAuth token validation in Progress MarkLogic Server Affected: 11.0.0 before 11.3.7; 12.0.0 before 12.1.0
CVE-2026-85957	7.5	0%	Oct 12	Improper XML external entity restriction in Progress MarkLogic Server SAML processing Affected: 11.0.0 before 11.3.7
CVE-2026-85974	7.4	0%	Oct 12	Improper TLS hostname verification in Progress MarkLogic Server Affected: 11.0.0 before 11.3.7; 12.0.0 before 12.1.0
CVE-2026-85973	7.4	0%	Oct 12	Cleartext transmission in Progress MarkLogic Server cluster join operations Affected: 12.0.0 before 12.1.0
CVE-2026-85972	7.4	0%	Oct 12	Improper Kerberos server verification in Progress MarkLogic Server Affected: 11.0.0 before 11.3.7; 12.0.0 before 12.1.0
CVE-2026-85971	7.1	0%	Oct 12	Incorrect log file permissions in Progress MarkLogic Server Affected: 11.0.0 before 11.3.7; 12.0.0 before 12.1.0
CVE-2026-85970	7.1	0%	Oct 12	Improper XML external entity restriction in Progress MarkLogic Server Affected: 11.0.0 before 11.3.7; 12.0.0 before 12.1.0
CVE-2026-85969	7.1	0%	Oct 12	Out-of-bounds write in Progress MarkLogic Server Affected: 11.0.0 before 11.3.7; 12.0.0 before 12.1.0
CVE-2026-85968	7.1	0%	Oct 12	Out-of-bounds read in Progress MarkLogic Server Affected: 12.0.0 before 12.1.0