The vulnerability arises from deprecated OpsDirector functionality that allows an unauthenticated attacker to form or alter internal service requests, effectively enabling Server Side Request Forgery (CWE‑918). Additionally, the presence of a hard‑coded encryption key (CWE‑321) compromises credential confidentiality, potentially allowing the exploitation of sensitive data or privileged operations.

Progress Software Corporation’s MarkLogic Server is affected. All 12.x releases prior to 12.1.0 and all 11.x releases prior to 11.3.7 contain the vulnerable OpsDirector code, which remains enabled by default unless explicitly disabled.

The CVSS score of 7.5 indicates a high severity risk, while the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalogue, and no confirmed exploitation has been reported. An attacker with network reach to the vulnerable instance could trigger internal requests without authentication, potentially exposing protected data or executing privileged operations. Given the lack of mitigation or exposure evidence, the risk is moderate to high because of the nature of the payload capability and the prevalence of the affected releases.