Progress SoftwareCVE-2026-9203

Progress Software MarkLogic Server: server-side request forgery

CVE-2026-9203 · Published Aug 5, 2026 · updated Sep 3, 2026

High8.5

Fix: upgrade to 11.3.6 or later (2 fixed versions below)

A server-side request forgery vulnerability in Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with low-privileged roles to bypass protections for cloud instance metadata endpoints. Successful exploitation can disclose cloud credentials and compromise cloud resources accessible to the host instance.

Affected versions

Package	Affected	Fixed in
MarkLogic Server Product	>= 11.0.0, < 11.3.6	11.3.6
	>= 12.0.0, < 12.0.3	12.0.3

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-918

More Progress Software advisories

All Progress Software

Critical 9.8Aug 5

Progress Software MarkLogic Server: authentication bypassCVE-2026-9192fixed in 11.3.6 +1 Critical 9.9Aug 5

Progress Software MarkLogic Server: privilege escalationCVE-2026-9193fixed in 11.3.6 +1 Critical 9.3Aug 5

Progress Software MarkLogic Server: cross-site scriptingCVE-2026-9195fixed in 11.3.6 +1 High 8.1Aug 5

Progress Software MarkLogic Server: privilege escalationCVE-2026-7327fixed in 11.3.6 +1 Critical 9.9Aug 5

Progress Software MarkLogic Server: privilege escalationCVE-2026-7329fixed in 11.3.6 +1 Critical 9.1Aug 5

Progress Software MarkLogic Server: authentication bypassCVE-2026-7557fixed in 11.3.6 +1