CVE-2026-85970 — Improper XML external entity restriction in Progress MarkLogic Server

CVE-2026-85970

Improper XML external entity restriction in Progress MarkLogic Server PUBLISHED

Description (CNA)

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 enable XML external entity processing by default in multiple server paths, which could allow crafted XML to cause server-side requests or disclosure of local files.

Affected (CNA)

Vendor / product	Versions
Progress Software Corporation / MarkLogic Server	affected 11.0.0 before 11.3.7; affected 12.0.0 before 12.1.0

CWE

CWE-611

References

https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-October-2026

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.