CVE-2026-85975

Progress MarkLogic Server (versions 12.x before 12.1.0 and 11.x before 11.3.7 ) may utilize cleartext transport for Amazon S3 connections by default. This vulnerability allows a network-positioned attacker to intercept sensitive data or credentials transmitted over an affected connection. No spec...

CVE-2026-85975 Cleartext transmission in Progress MarkLogic Server Amazon S3 connections

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may use cleartext transport for Amazon S3 connections by default. A network-positioned attacker could intercept data or credentials transmitted through an affected connection...

EUVD-2026-97571

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently validate TLS certificate hostnames for certain outbound connections. A network-positioned attacker could exploit this weakness to intercept or modify communications with an affected service...

CVE-2026-85974

Progress MarkLogic Server is vulnerable in 12.x releases before 12.1.0 and 11.x releases before 11.3.7 due to inconsistent TLS certificate hostname validation for specific outbound connections. A network-positioned attacker could exploit this weakness to intercept or modify communications with an...

CVE-2026-85974 Improper TLS hostname verification in Progress MarkLogic Server

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently validate TLS certificate hostnames for certain outbound connections. A network-positioned attacker could exploit this weakness to intercept or modify communications with an affected service...

CVE-2026-85973 Cleartext transmission in Progress MarkLogic Server cluster join operations

Progress MarkLogic Server 12.x releases before 12.1.0 may use cleartext transport for certain cluster-management communications. A network-positioned attacker could intercept or modify information transmitted through an affected connection...

CVE-2026-85973

Progress MarkLogic Server 12.x releases before 12.1.0 are vulnerable to cleartext transmission during certain cluster-management communications. This occurs because the system may use unencrypted transport for cluster join operations, potentially allowing a network-positioned attacker to intercep...

EUVD-2026-97570

Progress MarkLogic Server 12.x releases before 12.1.0 may use cleartext transport for certain cluster-management communications. A network-positioned attacker could intercept or modify information transmitted through an affected connection...

CVE-2026-85972

Progress MarkLogic Server versions 12.x (before 12.1.0) and 11.x (before 11.3.7) are vulnerable to improper Kerberos server verification . In specific password-based authentication configurations, the software fails to sufficiently verify the identity of the Kerberos authentication service. A net...

EUVD-2026-97567

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently verify the identity of a Kerberos authentication service in certain password-based authentication configurations. A network-positioned attacker could impersonate trusted authentication...

CVE-2026-85972 Improper Kerberos server verification in Progress MarkLogic Server

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently verify the identity of a Kerberos authentication service in certain password-based authentication configurations. A network-positioned attacker could impersonate trusted authentication...

EUVD-2026-97566

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 assign overly permissive operating-system permissions to certain log files, which could allow a local user to read or alter log data. The corrected default permissions apply to newly created and rotated logs;...

CVE-2026-85971

Progress MarkLogic Server versions 12.x before 12.1.0 and 11.x before 11.3.7 are affected by a vulnerability where certain log files are assigned overly permissive operating-system permissions . This configuration flaw could allow a local user to read or alter log data, potentially impacting conf...

CVE-2026-85971 Incorrect log file permissions in Progress MarkLogic Server

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 assign overly permissive operating-system permissions to certain log files, which could allow a local user to read or alter log data. The corrected default permissions apply to newly created and rotated logs;...

CVE-2026-85970

Progress MarkLogic Server versions 12.x before 12.1.0 and 11.x before 11.3.7 are vulnerable to improper XML external entity restriction. The software enables XML external entity processing by default in multiple server paths, which could allow an attacker to use crafted XML to trigger server-side...

EUVD-2026-97565

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 enable XML external entity processing by default in multiple server paths, which could allow crafted XML to cause server-side requests or disclosure of local files...

CVE-2026-85970 Improper XML external entity restriction in Progress MarkLogic Server

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 enable XML external entity processing by default in multiple server paths, which could allow crafted XML to cause server-side requests or disclosure of local files...

CVE-2026-85969

Progress MarkLogic Server versions 12.x before 12.1.0 and 11.x before 11.3.7 are vulnerable to an out-of-bounds write vulnerability within certain language-processing functionality . A remote authenticated attacker can exploit this flaw to cause server instability or achieve limited modification ...

CVE-2026-85969 Out-of-bounds write in Progress MarkLogic Server

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an out-of-bounds write vulnerability in certain language-processing functionality. A remote authenticated attacker could exploit this vulnerability to cause server instability or limited modification of...

EUVD-2026-97564

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an out-of-bounds write vulnerability in certain language-processing functionality. A remote authenticated attacker could exploit this vulnerability to cause server instability or limited modification of...