CVE-2026-85949

Awaiting Analysis Awaiting Analysis - Queue

Progress MarkLogic Server Information Exposure in Logs

Publication date: 2026-10-12

Last updated on: 2026-10-16

Assigner: Progress Software Corporation

Description

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive information in diagnostic logs under certain configurations. An attacker with access to the affected logs could use this information to obtain unauthorized access to protected resources.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-16

Generated

2026-11-08

AI Q&A

2026-10-12

EPSS Evaluated

2026-11-07

NVD

CVE-2026-85949

EUVD

EUVD-2026-97507

Affected Vendors & Products

Vendor	Product	Version / Range
Progress Software Corporation	MarkLogic Server	11.0.0
Progress Software Corporation	MarkLogic Server	12.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-532	The product writes sensitive information to a log file.

Attack-Flow Graph

Executive Summary

This vulnerability affects Progress MarkLogic Server versions before 12.1.0 and 11.3.7. It allows sensitive security information to be logged in diagnostic logs under specific configurations. Attackers with log access could exploit this to gain unauthorized access to protected resources.

Detection Guidance

Check MarkLogic Server diagnostic logs for sensitive information like credentials or access details. Search logs for patterns like passwords, tokens, or internal paths. Use commands like grep or findstr on log files (e.g., grep -i 'password' /var/opt/MarkLogic/Logs/*) depending on your OS.

Impact Analysis

If you use MarkLogic Server versions before 12.1.0 or 11.3.7, an attacker with access to diagnostic logs could obtain sensitive information. This may lead to unauthorized access to protected resources, compromising data security and system integrity.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating GDPR's data protection principles and HIPAA's security requirements. Non-compliance may result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade MarkLogic Server to version 12.1.0 or later for 12.x releases, or 11.3.7 or later for 11.x releases. Review and sanitize diagnostic logs to remove any sensitive data. Restrict log file access to authorized personnel only.

Hi! I’m here to help you understand CVE-2026-85949. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...