CVE-2026-85951
Server-side request forgery in Progress MarkLogic Server Azure deployments
Published Oct 12, 2026 · updated Oct 15, 2026 · Progress Software Corporation MarkLogic Server
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 on Azure contain a server-side request forgery vulnerability that could allow an authenticated attacker to access internal cloud services, potentially resulting in unauthorized access to cloud credentials or tokens.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Oct 12, 2026 · CIRCL Vulnerability Lookup
Detected
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 on Azure contain a server-side request forgery vulnerability that could allow an authenticated attacker to access internal cloud services, potentially resulting in unauthorized access to cloud credentials or tokens.
Oct 15, 2026 · CIRCL Vulnerability Lookup
Updated
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 on Azure contain a server-side request forgery vulnerability that could allow an authenticated attacker to access internal cloud services, potentially resulting in unauthorized access to cloud credentials or tokens.
Affected
- vendor Progress Software Corporation MarkLogic Serverversion unspecified
Sources
- CIRCL Vulnerability LookupVulnerability recordCVE-2026-85951
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 on Azure contain a server-side request forgery vulnerability that could allow an authenticated attacker to access internal cloud services, potentially resulting in unauthorized access to cloud c
vulnerability.circl.lu - CVE.orgVulnerability recordCVE-2026-85951
Official CVE identifier
cve.org