CVE-2026-9203

Name of the Vulnerable Software and Affected Versions Progress MarkLogic Server versions prior to 11.3.6 Progress MarkLogic Server versions prior to 12.0.3

Description A server-side request forgery (SSRF) - a flaw where an attacker induces the server to make requests to an unintended location - allows an authenticated user with low-privileged roles to bypass protections for cloud instance metadata endpoints. This can lead to the disclosure of cloud credentials and the compromise of cloud resources accessible to the host instance.

Recommendations Update to version 11.3.6 or later. Update to version 12.0.3 or later.