AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Progress SoftwareCVE-2026-7329

Progress Software MarkLogic Server: privilege escalation

Progress Software

CVE-2026-7329 · Published Aug 5, 2026 · updated Sep 3, 2026

Critical9.9
Fix: upgrade to 11.3.6 or later (2 fixed versions below)
Progress Software advisory

An improper privilege management vulnerability in the SQL, SPARQL, and Optic REST query interfaces of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges to administrator. This enables execution of privileged operations and unauthorized data access.

Affected versions

PackageAffectedFixed in
MarkLogic Server
Product
>= 11.0.0, < 11.3.611.3.6
>= 12.0.0, < 12.0.312.0.3
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-269

More Progress Software advisories

All Progress Software
Critical 9.8Aug 5Progress Software MarkLogic Server: authentication bypassCVE-2026-9192fixed in 11.3.6 +1Critical 9.9Aug 5Progress Software MarkLogic Server: privilege escalationCVE-2026-9193fixed in 11.3.6 +1Critical 9.3Aug 5Progress Software MarkLogic Server: cross-site scriptingCVE-2026-9195fixed in 11.3.6 +1High 8.5Aug 5Progress Software MarkLogic Server: server-side request forgeryCVE-2026-9203fixed in 11.3.6 +1High 8.1Aug 5Progress Software MarkLogic Server: privilege escalationCVE-2026-7327fixed in 11.3.6 +1Critical 9.1Aug 5Progress Software MarkLogic Server: authentication bypassCVE-2026-7557fixed in 11.3.6 +1