Progress MarkLogic Server versions 12.x before 12.1.0 and 11.x before 11.3.7 fail to consistently log successful authentication attempts. The primary impact is that security teams lose visibility into both authorized and unauthorized logins, reducing their ability to detect credential misuse or stealthy access. The weakness is classified as CWE-778, indicating missing audit logging for authentication events.

The vulnerability affects Progress Software Corporation’s MarkLogic Server. Users running 12.x releases older than 12.1.0 or 11.x releases older than 11.3.7 are impacted and should verify the running version and consider updating to a patched release.

The CVSS score of 7.5 places this finding in the high‑severity range. No direct exploitation vector that grants privilege escalation or remote code execution is documented; the risk lies in the inability to detect unauthorized credential usage. Because no EPSS score is available, the probability of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed public exploitation at this time. The likely attack vector is inferred as the absence of audit logs enabling attackers to use stolen or legitimate credentials without detection.