CVE-2026-85963: MarkLogic Server 11.0.0 to before 11.3.7, 12.0.0 to before 12.1.0

Affected technology

MarkLogic Server · 11.0.0 to before 11.3.7, 12.0.0 to before 12.1.0
Progress Software Corporation

Description’s affected range: before 12.1.0 and 11.x releases before 11.3.7 include deprecated OpsDirector functionality with weaknesses that could allow an unauthenticated remote attacker to make unauthorized requests to internal services or forge trusted requests

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An unauthenticated remote attacker could make unauthorized requests to internal services or forge trusted requests, potentially resulting in unauthorized access to protected information. Vendor/CNA’s CVSS 3.1 assessment (base score 7.5/10) rates confidentiality impact as high; integrity and availability impact as none.