The vulnerability is a server‑side request forgery that allows an attacker with valid credentials to instruct the MarkLogic Server to make HTTP requests to arbitrary URLs. This can be used to reach internal cloud services and retrieve sensitive cloud credentials, effectively giving the attacker unauthorized access to protected data and potentially to other services.

The affected products are Progress Software Corporation’s MarkLogic Server. Vulnerable releases include all Linux‑based 12.x versions before 12.1.0 and all 11.x versions before 11.3.7. Any deployment of those releases running in a cloud or internal network environment is at risk.

The CVSS score of 8.5 reflects a high severity that includes authentication, network attacks, and potential impact on confidentiality. The EPSS score is not available, so the exploit probability is unknown; however, the lack of a KEV listing suggests no widespread public exploitation yet. The exploit requires the attacker to already be authenticated to the server, but the ability to reach internal cloud services greatly increases the potential damage.