CVE-2026-8709
Critical · CVSS 9.9- CVSS
- 9.9
- nvd
- EPSS
- 0.31%
- 24th pct
- KEV
- No
- Class
- other
- CWE-269
Description
An improper privilege management vulnerability in the REST API document patch operation of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges and execute privileged operations against the Security database.
References
Status: profiled · ingested 2026-09-03T18:00:49.000Z