CVE-2026-8709
Privilege escalation in Progress MarkLogic Server REST document patch operation
CVSS Score
9.9
EPSS Score
0.0%
EPSS Percentile
0th
An improper privilege management vulnerability in the REST API document patch operation of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges and execute privileged operations against the Security database.
| CWE | CWE-269 |
| Vendor | progress software corporation |
| Product | marklogic server |
| Published | Aug 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for progress software corporation marklogic server
Be the first to know when new critical vulnerabilities affecting progress software corporation marklogic server are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
Progress Software Corporation / MarkLogic Server
11.0.0 < 11.3.6 12.0.0 < 12.0.3
References
Credits
rexnets via Bugcrowd