The vulnerability allows a malicious actor to craft XML that is processed by the MarkLogic Server’s XML parser, which by default resolves external entities. This can cause the server to perform unintended outbound requests or read local files, potentially exposing sensitive information or opening a path for further exploitation. The flaw is a classic instance of XML External Entity processing (CWE‑611).

Affected products are Progress Software Corporation’s MarkLogic Server. Versions prior to 12.1.0 (within the 12.x release line) and prior to 11.3.7 (within the 11.x release line) are impacted, as these releases enable XEE processing by default in multiple server paths.

With a CVSS score of 7.1 the vulnerability falls into the high severity range. No EPSS score is available, so the exploitation probability cannot be quantified from the CVSS alone. The vulnerability is exploitable remotely through any interface that accepts XML input to the server, which may require authenticated or unauthenticated access depending on the targeted endpoint. The vulnerability is not currently listed in the CISA KEV catalog, but the potential for data exposure warrants immediate attention.