Progress SoftwareCVE-2026-7557

Progress Software MarkLogic Server: authentication bypass

CVE-2026-7557 · Published Aug 5, 2026 · updated Sep 3, 2026

Critical9.1

Fix: upgrade to 11.3.6 or later (2 fixed versions below)

An improper verification of cryptographic signature vulnerability in the SAML authentication module of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker to bypass authentication and impersonate any user, including administrators. This vulnerability affects deployments with SAML single sign-on enabled.

Affected versions

Package	Affected	Fixed in
MarkLogic Server Product	>= 11.0.0, < 11.3.6	11.3.6
	>= 12.0.0, < 12.0.3	12.0.3

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-347

More Progress Software advisories

All Progress Software

Critical 9.8Aug 5

Progress Software MarkLogic Server: authentication bypassCVE-2026-9192fixed in 11.3.6 +1 Critical 9.9Aug 5

Progress Software MarkLogic Server: privilege escalationCVE-2026-9193fixed in 11.3.6 +1 Critical 9.3Aug 5

Progress Software MarkLogic Server: cross-site scriptingCVE-2026-9195fixed in 11.3.6 +1 High 8.5Aug 5

Progress Software MarkLogic Server: server-side request forgeryCVE-2026-9203fixed in 11.3.6 +1 High 8.1Aug 5

Progress Software MarkLogic Server: privilege escalationCVE-2026-7327fixed in 11.3.6 +1 Critical 9.9Aug 5

Progress Software MarkLogic Server: privilege escalationCVE-2026-7329fixed in 11.3.6 +1