---
id: CVE-2026-85963
title: >-
  Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before
  11.3.7 include deprecated OpsDirector functionality with weaknesses that could
  allow an unauthenticated remote attacker to make unauthorized requests to
  inter…
summary: >-
  Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before
  11.3.7 include deprecated OpsDirector functionality with weaknesses that could
  allow an unauthenticated remote attacker to make unauthorized requests to
  inter…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-321
  - CWE-918
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T17:17:36.753'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-85963'
references:
  - url: >-
      https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-October-2026
    label: security@progress.com
tags:
  - nvd
ingestedAt: '2026-10-12T18:00:08.220Z'
---

## Overview

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 include deprecated OpsDirector functionality with weaknesses that could allow an unauthenticated remote attacker to make unauthorized requests to internal services or forge trusted requests, potentially resulting in unauthorized access to protected information.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.