CVE-2026-85970

HIGHCVSS 7.1

Description

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 enable XML external entity processing by default in multiple server paths, which could allow crafted XML to cause server-side requests or disclosure of local files.

Timeline

Published:October 12th, 2026 5:17 PM

Last modified:October 15th, 2026 8:17 PM

CVSS Scoring

CVSS v3: 7.1 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

Weaknesses (CWE)

CWE-611

References & Reports

Advisories, patches, and third-party reports

https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-October-2026

Source: NIST NVD · Data may lag official sources by up to one minute