CVE-2026-85963— Server-side request forgery and hard-coded key in Progress MarkLogic Server OpsDirector
Quick assessment
Affected
Progress Software Corporation MarkLogic Server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Progress MarkLogic Server 12.x 版本中低于 12.1.0 的版本，以及 11.x 版本中低于 11.3.7 的版本，包含已弃用的 OpsDirector 功能，该功能存在安全弱点。攻击者无需认证即可从远程发起未经授权请求，访问内部服务，或伪造可信请求，可能导致受保护信息的未经授权访问。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Progress Software Corporation | MarkLogic Server | 11.0.0< 11.3.7 |
affected |
12.0.0< 12.1.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-85963
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Server-side request forgery and hard-coded key in Progress MarkLogic Server OpsDirector
Source: CVE Program / CVE List V5
Vulnerability Description
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 include deprecated OpsDirector functionality with weaknesses that could allow an unauthenticated remote attacker to make unauthorized requests to internal services or forge trusted requests, potentially resulting in unauthorized access to protected information.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Progress Software Corporation | MarkLogic Server | 11.0.0 ~ 11.3.7 | - |
|
II. Public POCs for CVE-2026-85963
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-85963
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-85963 (1)
Same Patch Batch · Progress Software Corporation · 2026-10-12 · 31 CVEs total
| CVE-2026-85947 | 9.9 CRITICAL | Improper privilege management in Progress MarkLogic Server forest operations |
| CVE-2026-85948 | 9.9 CRITICAL | Improper privilege management in Progress MarkLogic Server Management API |
| CVE-2026-85955 | 9.9 CRITICAL | Improper privilege management in Progress MarkLogic Server xdmp:eval-in |
| CVE-2026-85956 | 9.6 CRITICAL | Improper privilege management in Progress MarkLogic Server backup and restore operations |
| CVE-2026-9191 | 9.6 CRITICAL | Insufficient isolation of user-supplied code in Progress MarkLogic Server |
| CVE-2026-85954 | 8.6 HIGH | Improper privilege management in Progress MarkLogic Server higher-order XQuery functions |
| CVE-2026-85951 | 8.5 HIGH | Server-side request forgery in Progress MarkLogic Server Azure deployments |
| CVE-2026-85952 | 8.5 HIGH | Server-side request forgery in Progress MarkLogic Server Linux cloud deployments |
| CVE-2026-85953 | 8.5 HIGH | Path traversal and privilege management flaws in Progress MarkLogic Server InfoStudio |
| CVE-2026-85950 | 8.4 HIGH | Improper privilege management in Progress MarkLogic Server REST extensions |
| CVE-2026-85949 | 8.1 HIGH | Sensitive information exposure in Progress MarkLogic Server trace logs |
| CVE-2026-85965 | 8.0 HIGH | Use-after-free in Progress MarkLogic Server JavaScript engine integration |
| CVE-2026-85966 | 7.7 HIGH | Exposure of sensitive information in Progress MarkLogic Server |
| CVE-2026-85964 | 7.7 HIGH | Path traversal in Progress MarkLogic Server Query Console |
| CVE-2026-85960 | 7.5 HIGH | Cross-site request forgery in Progress MarkLogic Server Query Console |
| CVE-2026-85975 | 7.5 HIGH | Cleartext transmission in Progress MarkLogic Server Amazon S3 connections |
| CVE-2026-85958 | 7.5 HIGH | Improper OAuth token validation in Progress MarkLogic Server |
| CVE-2026-85961 | 7.5 HIGH | Sensitive information exposure in Progress MarkLogic Server Azure deployments |
| CVE-2026-85957 | 7.5 HIGH | Improper XML external entity restriction in Progress MarkLogic Server SAML processing |
| CVE-2026-85962 | 7.5 HIGH | Improper authentication in Progress MarkLogic Server SAML processing |
Showing top 20 of 31 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: MarkLogic Server
-
CVE-2026-85976
HTTP response splitting in Progress MarkLogic Server Query C -
CVE-2026-85975
Cleartext transmission in Progress MarkLogic Server Amazon S -
CVE-2026-85974
Improper TLS hostname verification in Progress MarkLogic Ser -
CVE-2026-85973
Cleartext transmission in Progress MarkLogic Server cluster -
CVE-2026-85972
Improper Kerberos server verification in Progress MarkLogic
Same vendor: Progress Software Corporation
-
CVE-2026-85976
HTTP response splitting in Progress MarkLogic Server Query C -
CVE-2026-85975
Cleartext transmission in Progress MarkLogic Server Amazon S -
CVE-2026-85974
Improper TLS hostname verification in Progress MarkLogic Ser -
CVE-2026-85973
Cleartext transmission in Progress MarkLogic Server cluster -
CVE-2026-85972
Improper Kerberos server verification in Progress MarkLogic
Same weakness: CWE-918
-
CVE-2026-110719
Portkey AI Gateway 1.14.0 through 1.15.2 SSRF via x-portkey- -
CVE-2026-110718
TurboDocx html-to-docx through 1.23.1 SSRF via img src Remot -
CVE-2026-78231
Gitea blind SSRF through OpenID assertion verification -
CVE-2026-25946
Gitea OpenID discovery server-side request forgery -
CVE-2026-110628
Kan 0.5.5 through 0.6.0 Unauthenticated SSRF via /api/downlo
V. Comments for CVE-2026-85963
No comments yet