Description
Affected Progress MarkLogic Server 11.x releases before 11.3.7 use a SAML parser configuration that can process external DTDs or entities, which could result in unintended network access or information disclosure.
Published: 2026-10-12
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure due to unintended network access
Action: Patch
AI Analysis

Impact

A vulnerability exists in the SAML parser of Progress MarkLogic Server that allows processing of external DTDs or entities during XML parsing. This misconfiguration can lead to unintended network access or sensitive data disclosure. The flaw maps to CWE-611, indicating insecure XML processing.

Affected Systems

Affected products include Progress Software Corporation’s MarkLogic Server. Versions prior to 11.3.7 of the 11.x release line are impacted; newer releases are believed to have the limitation removed.

Risk and Exploitability

The CVSS score of 7.5 reflects a high impact and moderate likelihood of exploitation. With no EPSS data and no listing in KEV, the exploitation probability is unknown but the lack of mitigation may make this a likely target, especially over publicly exposed SAML endpoints. An attacker could supply a crafted SAML assertion to trigger the parser to resolve external entities, potentially causing it to reach external services or reveal internal data.

Generated by OpenCVE AI on October 12, 2026 at 20:02 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to MarkLogic Server 11.3.7 or later.
  • If upgrade cannot be performed immediately, reconfigure the SAML XML parser to disallow external DTDs and entities.
  • Validate incoming SAML assertions and monitor logs for anomalous entity references.

Generated by OpenCVE AI on October 12, 2026 at 20:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 17 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 07:00:00 +0000

Type Values Removed Values Added
First Time appeared Progress Software Corporation
Progress Software Corporation marklogic Server
Vendors & Products Progress Software Corporation
Progress Software Corporation marklogic Server

Mon, 12 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Description Affected Progress MarkLogic Server 11.x releases before 11.3.7 use a SAML parser configuration that can process external DTDs or entities, which could result in unintended network access or information disclosure.
Title Improper XML external entity restriction in Progress MarkLogic Server SAML processing
Weaknesses CWE-611
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Progress Software Corporation Marklogic Server
cve-icon MITRE

Status: PUBLISHED

Assigner: ProgressSoftware

Published:

Updated: 2026-10-16T17:19:55.107Z

Reserved: 2026-09-04T18:43:01.396Z

Link: CVE-2026-85957

cve-icon Vulnrichment

Updated: 2026-10-16T17:03:14.253Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-12T17:17:35.990

Modified: 2026-10-16T18:19:28.393

Link: CVE-2026-85957

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T06:45:15Z

Weaknesses
  • CWE-611

    Improper Restriction of XML External Entity Reference