CVE-2026-85964 — Path traversal in Progress MarkLogic Server Query Console

CVE-2026-85964

Path traversal in Progress MarkLogic Server Query Console PUBLISHED

Description (CNA)

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow an authenticated Query Console user to supply unsafe path values to a privileged filesystem helper, which could result in disclosure of arbitrary server files.

Affected (CNA)

Vendor / product	Versions
Progress Software Corporation / MarkLogic Server	affected 11.0.0 before 11.3.7; affected 12.0.0 before 12.1.0

CWE

CWE-22

References

https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-October-2026

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.