Progress MarkLogic Server Multiple Vulnerabilities Advisory: Auth Bypass, Privilege Escalation, HTTP Smuggling

Vulnerability Overview Progress MarkLogic Server has confirmed multiple security vulnerabilities, including privilege escalation, authentication bypass, server-side request forgery, cross-site scripting, cross-origin resource sharing bypass, HTTP request smuggling, and server-side request forgery. These vulnerabilities may allow attackers to access or control affected MarkLogic Server instances without authorization. Affected Versions MarkLogic Server 12.0.0 - 12.0.1 MarkLogic Server 11.0.0 - 11.3.4 MarkLogic Server 10.x and earlier versions Remediation All customers are advised to upgrade to the latest version as soon as possible. Specific patched versions are as follows: MarkLogic Server 12.0.0 - 12.0.1: Upgrade to MarkLogic Server 12.0.3 MarkLogic Server 11.0.0 - 11.3.4: Upgrade to MarkLogic Server 11.3.6 MarkLogic Server 10.x and earlier versions: Upgrade to MarkLogic Server 12.0.3 or 11.3.6 Vulnerability Details 1. CVE-2026-7326 - CWE-352: Cross-Site Request Forgery (CSRF) - Before MarkLogic Server 11.3.6 and 12.0.3, remote attackers could execute administrative operations via malicious pages, potentially leading to unauthorized configuration changes. 2. CVE-2026-7327 - CWE-269: Improper Privilege Management - Before MarkLogic Server 11.3.6 and 12.0.3, authenticated users with the management REST role could exploit vulnerabilities in the REST API document processing pipeline to escalate privileges, potentially resulting in unauthorized disclosure of sensitive server-side data. 3. CVE-2026-7329 - CWE-269: Improper Privilege Management - Before MarkLogic Server 11.3.6 and 12.0.3, authenticated users with low-privilege REST roles could exploit vulnerabilities in the REST query endpoint to escalate privileges, potentially leading to unauthorized operations and data access. 4. CVE-2026-7557 - CWE-347: Improper Verification of Cryptographic Signature - Before MarkLogic Server 11.3.6 and 12.0.3, the SAML authentication module failed to correctly verify the cryptographic signature of SAML responses, allowing unauthenticated remote attackers to bypass authentication and impersonate any user. 5. CVE-2026-8709 - CWE-269: Improper Privilege Management - Before MarkLogic Server 11.3.6 and 12.0.3, authenticated users with low-privilege REST roles could exploit vulnerabilities in REST document patch operations to escalate privileges, potentially leading to unauthorized operations against secure databases. 6. CVE-2026-9190 - CWE-444: Inconsistent Interpretation of HTTP Requests - Before MarkLogic Server 11.3.6 and 12.0.3, the MarkLogic HTTP App Server inconsistently interprets HTTP requests, allowing remote attackers to bypass authentication and authorization checks, hijack legitimate user sessions, or capture credentials. 7. CVE-2026-9192 - CWE-287: Improper Authentication - Before MarkLogic Server 11.3.6 and 12.0.3, unauthenticated remote attackers could bypass password verification to execute queries with the permissions of any known user, including administrators. 8. CVE-2026-9193 - CWE-269: Improper Privilege Management - Before MarkLogic Server 11.3.6 and 12.0.3, authenticated users with the low-privilege Hadoop role could exploit vulnerabilities in the MarkLogic ODBC App Server integration to escalate privileges, potentially leading to unauthorized operations against secure databases. 9. CVE-2026-9195 - CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) - Before MarkLogic Server 11.3.6 and 12.0.3, MarkLogic Query Console allows remote attackers to execute arbitrary JavaScript via crafted URLs, capturing credentials and performing privileged operations on behalf of administrators. 10. CVE-2026-9203 - CWE-918: Server-Side Request Forgery (SSRF) - Before MarkLogic Server 11.3.6 and 12.0.3, authenticated users with low-privilege roles could bypass MarkLogic protections to make requests to cloud instance metadata endpoints, resulting in the disclosure of cloud credentials and further exploitation of accessible cloud resources on the host instance. Additional Information Affected Versions: MarkLogic Server 12.0.0 - 12.0.1, 11.0.0 - 11.3.4, 10.x and earlier versions Fixed Versions: MarkLogic Server 12.0.3, 11.3.6 Upgrade Guide: Upgrading from Previous Releases Verify Current Version: Run in Query Console or view the System Status page in the Admin UI (default port 8001) Environment Last Modified: August 5, 2026, 3:13 PM Disclaimer The information provided on this page is for reference only. Progress Software Corporation does not guarantee the accuracy or applicability of the information. Files No file attachments Related Links Progress Community Portal Progress Alert and Notification Service (PANS) Footer Copyright: © 2026 Progress Software Corporation and its subsidiaries or affiliates. All rights reserved. Terms: Terms of Use Ads No ad content Navbar Home Product Downloads Product Forum More Search Search Box Login Login Button Feedback Was this helpful? - Yes - No Related Art

Goal Reached Thanks to every supporter — we hit 100%!

Progress MarkLogic Server Multiple Vulnerabilities Advisory: Auth Bypass, Privilege Escalation, HTTP Smuggling