---
id: CVE-2026-85959
title: >-
  Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before
  11.3.7 do not consistently record successful authentication events in audit
  logs, which could limit customers' ability to detect and investigate
  unauthorized …
summary: >-
  Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before
  11.3.7 do not consistently record successful authentication events in audit
  logs, which could limit customers' ability to detect and investigate
  unauthorized …
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'
cwe:
  - CWE-778
vendor: Progress Software Corporation
product: MarkLogic Server
affected:
  - marklogic_server >= 11.0.0 < 11.3.7
  - marklogic_server >= 12.0.0 < 12.1.0
published: '2026-10-12'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T19:17:45.063'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-85959'
references:
  - url: >-
      https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-October-2026
    label: security@progress.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-15T18:00:44.506526Z'
epss: 0.00397
epssPercentile: 0.3369
ingestedAt: '2026-10-12T18:00:08.219Z'
---

## Overview

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently record successful authentication events in audit logs, which could limit customers' ability to detect and investigate unauthorized access or credential misuse.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.