by Kastro
Paper/Archive/CVE-2026-7329

CVE-2026-7329

Progress Software Corporation MarkLogic Server — Privilege escalation in Progress MarkLogic Server REST query interfaces

EPSS 0.6%CVSS 9.9
critical.is priorityof 100
39
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 47.2.472 × 209.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An improper privilege management vulnerability in the SQL, SPARQL, and Optic REST query interfaces of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges to administrator. This enables execution of privileged operations and unauthorized data access.

Affected

ProductAffectedFixed inSource
MarkLogic Server11.0.0 – < 11.3.611.3.6CNA
MarkLogic Server12.0.0 – < 12.0.312.0.3CNA

Scores by source

ProgressSoftware (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisorycommunity.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-August-2026