CVE-2026-85958
Received Received - Intake

Authentication Bypass in Progress MarkLogic Server

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: Progress Software Corporation

Description
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authentication validation weakness that could allow an attacker to use a token that should not be accepted by the affected server, which could result in unauthorized access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-85958
EUVD
EUVD-2026-97680

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Progress Software Corporation MarkLogic Server 11.0.0
Progress Software Corporation MarkLogic Server 12.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authentication validation weakness in Progress MarkLogic Server versions before 12.1.0 (12.x) and 11.3.7 (11.x). It allows an attacker to use a token that should not be accepted, potentially leading to unauthorized access to the server.

Impact Analysis

An attacker could exploit this to gain unauthorized access to the MarkLogic Server, potentially leading to data breaches, unauthorized data manipulation, or further network compromise depending on the server's configuration and data stored.

Compliance Impact

This vulnerability could lead to unauthorized access, which may result in non-compliance with regulations like GDPR (data protection) or HIPAA (health data privacy) due to potential data exposure or breaches. Organizations using affected versions must address this to maintain compliance.

Mitigation Strategies

Upgrade Progress MarkLogic Server to version 12.1.0 or later if using 12.x, or to version 11.3.7 or later if using 11.x. This addresses the authentication validation weakness and prevents unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85958. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart