Vulnerabilities

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently sanitize input used by the Query Console…

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently sanitize input used by the Query Console file-exploration endpoint, which could allow HTTP response splitting and unintended client-side response handling.

Read at NIST National Vulnerability Database (CVE API 2.0)

CVSS

5.4

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-85976 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 15
   CVE NVD 19d ago

   Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may use cleartext transport for Amazon S3 connections by…

   CVSS 7.5 CVE-2026-85975 Amazon Web Services
2. 10
   CVE NVD 19d ago

   Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently validate TLS certificate hostnames for…

   CVSS 7.4 CVE-2026-85974
3. 28
   CVE NVD 19d ago

   Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently verify the identity of a Kerberos…

   CVSS 7.4 CVE-2026-85972 Microsoft
4. 10
   CVE NVD 19d ago

   Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently restrict access to certain…

   CVSS 7.7 CVE-2026-85966
5. 21
   CVE NVD 19d ago

   On Azure deployments, Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive…

   CVSS 7.5 CVE-2026-85961 Microsoft
6. 10
   CVE NVD 19d ago

   Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently record successful authentication events in…

   CVSS 7.5 CVE-2026-85959