Progress MarkLogic Server: Sensitive information exposure in diagnostic logs
Summary
MarkLogic Server writes security-sensitive information into diagnostic logs under certain configurations. An attacker who can read these logs could use the information to gain unauthorized access to protected resources. The default configuration is not affected, according to the vendor's affected-version data, and the triggering configurations are not named in the sources.
Affected
- MarkLogic Server 11.0.0 to before 11.3.7
- MarkLogic Server 12.0.0 to before 12.1.0
- Default configuration: not affected (per CNA record)
Fixed in
- MarkLogic Server 11.3.7
- MarkLogic Server 12.1.0
Workaround
Unknown. No workaround is documented in the sources.
Interim measures (not from a vendor source): restrict read access to ErrorLog and diagnostic files to the MarkLogic service account and administrators, and review who can access log storage and backups.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Not listed in the CISA KEV catalog.
- No public proof-of-concept or confirmed exploitation found; this is not confirmed absent.
Our recommendation
- Identify all MarkLogic 11.x and 12.x instances and their versions.
- Plan the upgrade to 11.3.7 or 12.1.0 and use mlcp 11.3.7 or 12.1.0, since older mlcp versions fail with XDMP-ISOLATED.
- Check upgrade side effects: removed /manage/v2/packages API, InfoStudio and OpsDirector, and new log file permissions (0640).
- Until patched, restrict log file access and review logs and log pipelines for exposed data; rotate credentials that may have appeared in logs.
- Check whether each instance is reachable from the internet.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Progress MarkLogic Critical Security Alert Bulletin (October 2026) community.progress.com
- OpenCVE entry CVE-2026-85949 app.opencve.io
- The Hacker News: Two critical MarkLogic flaws thehackernews.com
- OffSeq Radar entry CVE-2026-85949 radar.offseq.com
- Securityonline: Critical MarkLogic Server vulnerabilities securityonline.info
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:00.
Original description (NVD)
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive information in diagnostic logs under certain configurations. An attacker with access to the affected logs could use this information to obtain unauthorized access to protected resources.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.