CVE-2026-85957: Progress Software Corporation Marklogic Server

High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days.

Affected Progress MarkLogic Server 11.x releases before 11.3.7 use a SAML parser configuration that can process external DTDs or entities, which could result in unintended network access or information disclosure.

Affected products

• Progress Software Corporation Marklogic Server: from 11.0.0, before 11.3.7 (fixed in 11.3.7)

Published 2026-10-12. Last modified 2026-10-16.