CVE-2026-85971: Progress Software Corporation Marklogic Server

High severity, CVSS 7.1. EPSS: 0.1% chance of exploitation in the next 30 days.

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 assign overly permissive operating-system permissions to certain log files, which could allow a local user to read or alter log data. The corrected default permissions apply to newly created and rotated logs; existing logs retain their current permissions until remediated.

Affected products

• Progress Software Corporation Marklogic Server: from 11.0.0, before 11.3.7 (fixed in 11.3.7); from 12.0.0, before 12.1.0 (fixed in 12.1.0)

Published 2026-10-12. Last modified 2026-10-15.