CVE-2026-85959
Received Received - Intake

Authentication Bypass in Progress MarkLogic Server

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: Progress Software Corporation

Description
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently record successful authentication events in audit logs, which could limit customers' ability to detect and investigate unauthorized access or credential misuse.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-85959
EUVD
EUVD-2026-97673

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Progress Software Corporation MarkLogic Server 11.0.0
Progress Software Corporation MarkLogic Server 12.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-778 When a security-critical event occurs, the product either does not record the event or omits important details about the event when logging it.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Progress MarkLogic Server versions before 12.1.0 and 11.3.7. It allows successful authentication events to go unreported in audit logs, making it harder to detect unauthorized access or credential misuse.

Detection Guidance

Check MarkLogic Server audit logs for successful authentication events. Ensure logs are enabled and review for any missing or inconsistent entries that may indicate unauthorized access attempts.

Impact Analysis

Attackers could exploit this to gain unauthorized access without leaving a trace in logs. Organizations may struggle to detect breaches or investigate misuse of credentials, increasing risk of data theft or system compromise.

Compliance Impact

This vulnerability could violate compliance requirements that mandate audit logging for authentication events, such as GDPR's accountability principle or HIPAA's audit control safeguards. Non-compliance may lead to penalties or legal consequences.

Mitigation Strategies

Upgrade to MarkLogic Server 12.1.0 or 11.3.7 or later to address the inconsistent authentication logging issue. Verify audit log configurations are properly set to capture all authentication events.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85959. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart