CVE-2026-85970 — Improper XML external entity restriction in Progress MarkLogic Server
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 enable XML external entity processing by default in multiple server paths, which could allo…
Published: 2026-10-12 · CVSS: 7.1 · CVSS 3.1
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 enable XML external entity processing by default in multiple server paths, which could allow crafted XML to cause server-side requests or disclosure of local files.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7