# Progress Marklogic Server vulnerabilities Source: https://junglewise.ai/threats/technologies/marklogic-server Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/marklogic-server.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 41 vulnerabilities in Progress Marklogic Server: 0 in the last 7 days and 31 in the last 90 days, 12 of them critical and 0 exploited in the wild. The most recent, CVE-2026-85976, was published on 12 October 2026. 31 vulnerabilities in the last four weeks, up from none in the four before. 5 critical against 0. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 31 - All time: 41 (12 critical, 0 exploited in the wild) ## About Progress Marklogic Server Progress MarkLogic is a NoSQL document database for enterprise content management. ## Latest Progress Marklogic Server vulnerabilities - [CVE-2026-85976: Progress MarkLogic Server HTTP response splitting in Query Console](https://junglewise.ai/threats/cve-2026-85976-progress-marklogic-server-12-x-releases-before-12-1-0-and-11-x) (medium, CVSS 5.4, published 12 Oct 2026) - [CVE-2026-85975: Progress MarkLogic Server cleartext S3 transport default](https://junglewise.ai/threats/cve-2026-85975-progress-marklogic-server-12-x-releases-before-12-1-0-and-11-x) (high, CVSS 7.5, published 12 Oct 2026) - [CVE-2026-85974: Progress MarkLogic Server TLS hostname validation bypass](https://junglewise.ai/threats/cve-2026-85974-progress-marklogic-server-12-x-releases-before-12-1-0-and-11-x) (high, CVSS 7.4, published 12 Oct 2026) - [CVE-2026-85973: Progress MarkLogic Server cleartext cluster-management communications](https://junglewise.ai/threats/cve-2026-85973-progress-marklogic-server-12-x-releases-before-12-1-0-may-use) (high, CVSS 7.4, published 12 Oct 2026) - [CVE-2026-85972: Progress MarkLogic Server Kerberos authentication verification bypass](https://junglewise.ai/threats/cve-2026-85972-progress-marklogic-server-12-x-releases-before-12-1-0-and-11-x) (high, CVSS 7.4, published 12 Oct 2026) - [CVE-2026-85971: Progress MarkLogic Server log file permission disclosure](https://junglewise.ai/threats/cve-2026-85971-progress-marklogic-server-12-x-releases-before-12-1-0-and-11-x) (high, CVSS 7.1, published 12 Oct 2026) - [CVE-2026-85970: Progress MarkLogic Server XXE in XML processing](https://junglewise.ai/threats/cve-2026-85970-progress-marklogic-server-12-x-releases-before-12-1-0-and-11-x) (high, CVSS 7.1, published 12 Oct 2026) - [CVE-2026-85969: Progress MarkLogic Server out-of-bounds write in language processing](https://junglewise.ai/threats/cve-2026-85969-progress-marklogic-server-12-x-releases-before-12-1-0-and-11-x) (high, CVSS 7.1, published 12 Oct 2026) - [CVE-2026-85968: Progress MarkLogic Server out-of-bounds read in query processing](https://junglewise.ai/threats/cve-2026-85968-progress-marklogic-server-12-x-releases-before-12-1-0-contain-an) (high, CVSS 7.1, published 12 Oct 2026) - [CVE-2026-85967: Progress MarkLogic Server cross-site scripting](https://junglewise.ai/threats/cve-2026-85967-progress-marklogic-server-12-x-releases-before-12-1-0-and-11-x) (medium, CVSS 6.1, published 12 Oct 2026) - [CVE-2026-85966: Progress MarkLogic Server insufficient access restriction](https://junglewise.ai/threats/cve-2026-85966-progress-marklogic-server-12-x-releases-before-12-1-0-and-11-x) (high, CVSS 7.7, published 12 Oct 2026) - [CVE-2026-85965: Progress MarkLogic Server memory safety defect in JavaScript engine](https://junglewise.ai/threats/cve-2026-85965-progress-marklogic-server-12-x-releases-before-12-1-0-and-11-x) (high, CVSS 8, published 12 Oct 2026) - [CVE-2026-85964: Progress MarkLogic Server arbitrary file disclosure via Query Console](https://junglewise.ai/threats/cve-2026-85964-progress-marklogic-server-12-x-releases-before-12-1-0-and-11-x) (high, CVSS 7.7, published 12 Oct 2026) - [CVE-2026-85963: Progress MarkLogic Server authentication bypass in OpsDirector](https://junglewise.ai/threats/cve-2026-85963-progress-marklogic-server-12-x-releases-before-12-1-0-and-11-x) (high, CVSS 7.5, published 12 Oct 2026) - [CVE-2026-85962: Progress MarkLogic Server improper SAML authentication](https://junglewise.ai/threats/cve-2026-85962-progress-marklogic-server-12-x-releases-before-12-1-0-and-11-x) (high, CVSS 7.5, published 12 Oct 2026) - [CVE-2026-85961: Progress MarkLogic Server sensitive information disclosure in diagnostic logs](https://junglewise.ai/threats/cve-2026-85961-on-azure-deployments-progress-marklogic-server-12-x-releases) (high, CVSS 7.5, published 12 Oct 2026) - [CVE-2026-85960: Progress MarkLogic Server predictable CSRF tokens in Query Console](https://junglewise.ai/threats/cve-2026-85960-progress-marklogic-server-12-x-releases-before-12-1-0-and-11-x) (high, CVSS 7.5, published 12 Oct 2026) - [CVE-2026-85959: Progress MarkLogic Server audit log missing authentication events](https://junglewise.ai/threats/cve-2026-85959-progress-marklogic-server-12-x-releases-before-12-1-0-and-11-x) (high, CVSS 7.5, published 12 Oct 2026) - [CVE-2026-85958: Progress MarkLogic Server authentication validation weakness](https://junglewise.ai/threats/cve-2026-85958-progress-marklogic-server-12-x-releases-before-12-1-0-and-11-x) (high, CVSS 7.5, published 12 Oct 2026) - [CVE-2026-85957: Progress MarkLogic Server XXE injection in SAML parser](https://junglewise.ai/threats/cve-2026-85957-affected-progress-marklogic-server-11-x-releases-before-11-3-7) (high, CVSS 7.5, published 12 Oct 2026) - [CVE-2026-9191: Progress MarkLogic Server code isolation bypass in REST and XDBC](https://junglewise.ai/threats/cve-2026-9191-progress-marklogic-server-12-x-releases-before-12-1-0-and-11-x) (critical, CVSS 9.6, published 12 Oct 2026) - [CVE-2026-85956: Progress MarkLogic Server privilege escalation in backup/restore](https://junglewise.ai/threats/cve-2026-85956-progress-marklogic-server-12-x-releases-before-12-1-0-and-11-x) (critical, CVSS 9.6, published 12 Oct 2026) - [CVE-2026-85955: Progress MarkLogic Server privilege escalation in XQuery evaluation](https://junglewise.ai/threats/cve-2026-85955-progress-marklogic-server-12-x-releases-before-12-1-0-and-11-x) (critical, CVSS 9.9, published 12 Oct 2026) - [CVE-2026-85954: Progress MarkLogic Server privilege escalation in XQuery evaluation](https://junglewise.ai/threats/cve-2026-85954-progress-marklogic-server-12-x-releases-before-12-1-0-and-11-x) (high, CVSS 8.6, published 12 Oct 2026) - [CVE-2026-85953: Progress MarkLogic Server path traversal in InfoStudio](https://junglewise.ai/threats/cve-2026-85953-progress-marklogic-server-12-x-releases-before-12-1-0-and-11-x) (high, CVSS 8.5, published 12 Oct 2026) ## Most severe Progress Marklogic Server vulnerabilities - [CVE-2026-7329: Progress MarkLogic Server privilege escalation in query interfaces](https://junglewise.ai/threats/cve-2026-7329-progress-marklogic-server-privilege-escalation-in-query-interfaces) (critical, CVSS 9.9, published 5 Aug 2026) - [CVE-2026-9193: Progress MarkLogic Server privilege escalation in Hadoop integration](https://junglewise.ai/threats/cve-2026-9193-progress-marklogic-server-privilege-escalation-in-hadoop) (critical, CVSS 9.9, published 5 Aug 2026) - [CVE-2026-8709: Progress MarkLogic Server REST API privilege escalation in document patch](https://junglewise.ai/threats/cve-2026-8709-progress-marklogic-server-rest-api-privilege-escalation-in) (critical, CVSS 9.9, published 5 Aug 2026) - [CVE-2026-85955: Progress MarkLogic Server privilege escalation in XQuery evaluation](https://junglewise.ai/threats/cve-2026-85955-progress-marklogic-server-12-x-releases-before-12-1-0-and-11-x) (critical, CVSS 9.9, published 12 Oct 2026) - [CVE-2026-85948: Progress MarkLogic Server XQuery injection in Management API](https://junglewise.ai/threats/cve-2026-85948-progress-marklogic-server-12-x-releases-before-12-1-0-and-11-x) (critical, CVSS 9.9, published 12 Oct 2026) - [CVE-2026-85947: Progress MarkLogic Server authorization flaw in forest management](https://junglewise.ai/threats/cve-2026-85947-progress-marklogic-server-12-x-releases-before-12-1-0-and-11-x) (critical, CVSS 9.9, published 12 Oct 2026) - [CVE-2026-9192: Progress MarkLogic Server ODBC authentication bypass](https://junglewise.ai/threats/cve-2026-9192-progress-marklogic-server-odbc-authentication-bypass) (critical, CVSS 9.8, published 5 Aug 2026) - [CVE-2026-85956: Progress MarkLogic Server privilege escalation in backup/restore](https://junglewise.ai/threats/cve-2026-85956-progress-marklogic-server-12-x-releases-before-12-1-0-and-11-x) (critical, CVSS 9.6, published 12 Oct 2026) - [CVE-2026-9191: Progress MarkLogic Server code isolation bypass in REST and XDBC](https://junglewise.ai/threats/cve-2026-9191-progress-marklogic-server-12-x-releases-before-12-1-0-and-11-x) (critical, CVSS 9.6, published 12 Oct 2026) - [CVE-2026-9195: Progress MarkLogic Server cross-site scripting in Query Console](https://junglewise.ai/threats/cve-2026-9195-progress-marklogic-server-cross-site-scripting-in-query-console) (critical, CVSS 9.3, published 5 Aug 2026) ## Vulnerabilities per week 31 vulnerabilities in the last four weeks, up from none in the four before. 5 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 31 | 5 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Progress technologies - [Progress MOVEit Transfer](https://junglewise.ai/threats/technologies/moveit-transfer): 26 vulnerabilities - [Progress Kendo UI for jQuery](https://junglewise.ai/threats/technologies/kendo-ui-for-jquery): 25 vulnerabilities - [Progress WhatsUp Gold](https://junglewise.ai/threats/technologies/whatsup-gold): 7 vulnerabilities - [Progress LoadMaster](https://junglewise.ai/threats/technologies/loadmaster): 6 vulnerabilities - [Progress Sitefinity](https://junglewise.ai/threats/technologies/sitefinity): 6 vulnerabilities - [Progress ADC](https://junglewise.ai/threats/technologies/adc): 5 vulnerabilities - [Progress Connection Manager for ObjectScale](https://junglewise.ai/threats/technologies/connection-manager-for-objectscale): 5 vulnerabilities - [Progress ECS Connection Manager](https://junglewise.ai/threats/technologies/ecs-connection-manager): 5 vulnerabilities - [Progress Telerik Document Processing Libraries](https://junglewise.ai/threats/technologies/telerik-document-processing-libraries): 5 vulnerabilities - [Progress Telerik Report Server](https://junglewise.ai/threats/technologies/telerik-report-server): 5 vulnerabilities - [Progress ShareFile Storage Zones Controller](https://junglewise.ai/threats/technologies/progress-sharefile-storage-zones-controller): 4 vulnerabilities - [Progress Kendo Ui](https://junglewise.ai/threats/technologies/kendo-ui): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Progress Marklogic Server vulnerabilities", https://junglewise.ai/threats/technologies/marklogic-server, 13 November 2026.