Loading story…
Progress Software issued a critical security bulletin for MarkLogic Server covering 10 vulnerabilities, with 7 rated critical and 3 rated high severity, and urged customers to upgrade immediately. The flaws affect releases before 11.3.6 in the 11.x branch and before 12.0.3 in the 12.x branch and span the HTTP App Server, ODBC App Server, Query Console, REST API document patch operation, Hadoop integration, and AWS deployments. Government advisories from Canada and Italy echoed the vendor warning and directed administrators to apply the available updates.
The most serious issues include CVE-2026-9192, an authentication bypass in the ODBC App Server that can let an unauthenticated attacker run queries as any known user, including administrators; CVE-2026-9190, an HTTP request smuggling flaw that can bypass authentication and hijack sessions; CVE-2026-9193 and CVE-2026-8709, privilege-escalation bugs that can grant low-privileged users access to the Security database; CVE-2026-9195, a Query Console XSS issue that can execute attacker-controlled JavaScript in an administrator session; and CVE-2026-9203, an SSRF vulnerability on AWS that can expose cloud instance metadata and credentials. Progress said successful exploitation could give attackers unauthorized access to, or control over, affected MarkLogic Server instances.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security published advisory AV26-781 warning that multiple vulnerabilities affect Progress MarkLogic Server prior to versions 11.3.6 and 12.0.3. The notice directed users and administrators to review vendor advisories and apply updates as they become available.
In the August 2026 bulletin, Progress said patched versions of MarkLogic Server were available and strongly recommended customers upgrade immediately. The fixes address 10 vulnerabilities affecting the product.
Progress issued a critical security alert bulletin for MarkLogic Server covering 10 CVEs, including CVE-2026-8709, CVE-2026-9190, CVE-2026-9192, CVE-2026-9193, CVE-2026-9195, and CVE-2026-9203. The company said exploitation could allow unauthorized access to or control of affected instances.
Several MarkLogic Server vulnerabilities, including CVE-2026-8709, CVE-2026-9190, CVE-2026-9192, CVE-2026-9193, CVE-2026-9195, and CVE-2026-9203, were received by security@progress.com. The issues span privilege escalation, request smuggling, authentication bypass, XSS, and SSRF flaws.
Italy's ACN reported that Progress released security updates for MarkLogic Server to fix 10 vulnerabilities, seven rated critical and three rated high. The notice advised users to update affected installations in line with the vendor bulletin.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
11 references tracked. Mallory keeps watching after this page renders.
acn.gov.it
Open sourcemalware.news
Open sourcecyber.gc.ca
Open sourcecert.gov.py
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecommunity.progress.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Progress Software disclosed five high-severity vulnerabilities affecting **LoadMaster**, **ECS Connection Manager**, **Connection Manager for ObjectScale**, **MOVEit WAF**, and, for one issue, **Multi-Tenant LoadMaster**. The flaws, tracked as `CVE-2026-59686` through `CVE-2026-59690`, include three authenticated OS command injection bugs and two authorization failures. `CVE-2026-59689` can let a low-privileged authenticated user escalate to **root**, while `CVE-2026-59690` allows unauthorized administrative actions through the **REST API**; the command injection issues (`CVE-2026-59686`, `CVE-2026-59687`, and `CVE-2026-59688`) affect the management interface, Geo Location management interface, and backup restore functionality, respectively. Progress said it has **no reports of active exploitation**, **no known direct customer impact**, and **no indicators of compromise** so far, but warned that successful exploitation could lead to full appliance compromise. The vulnerabilities carry **CVSS 3.1 scores of 8.0 to 8.4**, affect older product releases, and require authentication, prompting the vendor to urge immediate upgrades to fixed versions. Defenders are advised to tighten privileged account access, enforce strong authentication controls such as MFA where available, and closely monitor management interfaces and REST API activity for suspicious behavior.
Jul 29, 2026
Progress disclosed two high-severity OS command injection vulnerabilities in its ADC product line, including **LoadMaster**, **ECS Connection Manager**, **Object Scale Connection Manager**, and **MOVEit WAF**. The issues, tracked as `CVE-2026-3517` and `CVE-2026-3519`, affect the API and can lead to remote code execution when authenticated administrators submit unsanitized input to specific commands. Both flaws are classified as `CWE-77` and carry a `CVSS v3.1` vector of `AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`, indicating high impact across confidentiality, integrity, and availability. `CVE-2026-3517` allows an attacker with **Geo Administration** permissions to exploit the `addcountry` command, while `CVE-2026-3519` requires **VS Administration** permissions to abuse the `aclcontrol` command. In both cases, Progress said arbitrary commands could be executed through the vulnerable API, and the vendor published an advisory covering these and related CVEs. Organizations using affected appliances should prioritize reviewing administrative access and applying vendor guidance to reduce exposure to authenticated abuse paths.
Jun 29, 2026
Progress released security updates for **Sitefinity CMS**, **Sitefinity Insight**, and **Kemp LoadMaster**, with the most urgent attention on multiple severe Sitefinity web-service vulnerabilities affecting versions from **8.0 through 15.4**. The Canadian Centre for Cyber Security flagged the vendor advisories and urged administrators to review Progress bulletins and apply patches. Among the Sitefinity issues, **`CVE-2026-7312`** carries a **CVSS 10.0** rating and can let an unauthenticated attacker obtain plaintext credentials used for **Sitefinity Insight** connections when that integration is enabled in a non-default configuration, while **`CVE-2026-7198`** is rated **CVSS 9.8** and allows unauthenticated access to restricted content in affected **15.4** deployments. Additional Sitefinity flaws include **`CVE-2026-7201`**, an authorization bypass that can let an authenticated low-privilege user modify other users' account properties, and **`CVE-2026-7313`**, which exposes Insight credentials to authenticated back-end users under specific configurations. Progress published patched releases including **15.4.8630**, **15.3.8531**, **15.2.8441**, **15.1.8335**, **15.0.8234**, **14.4.8152**, and **13.3.7652**, and warned that delaying remediation leaves OData and related web services open to unauthorized exploitation. The broader advisory set also includes two vulnerabilities affecting **Progress Kemp LoadMaster**.
Jun 29, 2026