An improper privilege management vulnerability in the REST API document patch operation of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenti…

A critical improper privilege management vulnerability (CVE-2026-8709) has been identified in Progress MarkLogic Server. The flaw exists in the REST API document patch operation and affects versions prior to 11.3.6 and 12.0.3. An authenticated user with a low-privileged REST role can exploit this vulnerability to escalate privileges. Successful exploitation allows the attacker to execute privileged operations against the Security database. This represents a significant risk as it enables unauthorized access to sensitive security configurations. Progress has issued a Critical Security Alert Bulletin in August 2026 addressing this issue. Users are urged to upgrade to the patched versions (11.3.6 or 12.0.3) immediately to mitigate exposure.