An attacker with valid authentication to a Progress MarkLogic Server deployed on Azure can issue internal requests to cloud services, a server‑side request forgery flaw that exposes credentials or tokens. Based on the description, it is inferred that the attacker could obtain sensitive access to Azure resources; potential pivot to other cloud assets would depend on additional permissions, which are not directly documented.

Progress Software Corporation's MarkLogic Server 12.x versions earlier than 12.1.0 and 11.x versions earlier than 11.3.7 running on Azure are affected.

The measured CVSS score of 8.5 indicates a high severity. The EPSS score is not available, so the current exploitation probability is uncertain, and the vulnerability is not yet listed in the CISA KEV catalog. The most likely exploitation path requires an authenticated user, suggesting that pre‑existing privileged accounts could be abused to trigger the malicious cloud service calls.