CVE-2026-7327 Privilege escalation in Progress MarkLogic Server REST API document processing
An authenticated user with an administrative REST role can escalate privileges to access sensitive server-side data in Progress MarkLogic Server.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-7327?
CVE-2026-7327 is a high-severity vulnerability in Progress Software Corporation MarkLogic Server, published on 5 Aug 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
An improper privilege management vulnerability in the REST API document processing pipeline of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with an administrative REST role to escalate privileges. This can result in unauthorized disclosure of sensitive server-side data when it is accessed by a higher-privileged user.
Weakness: CWE-269
Which versions are affected by CVE-2026-7327?
It affects 1 product.
Products include Progress Marklogic Server.
How do I fix CVE-2026-7327?
No fix has been published for CVE-2026-7327 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-7327 being exploited?
There is no known exploitation of CVE-2026-7327 in the wild and no public exploit code.
Other vulnerabilities in Progress Software Corporation MarkLogic Server
- CVE-2026-7329 Privilege escalation in Progress MarkLogic Server REST query interfaces
- CVE-2026-8709 Privilege escalation in Progress MarkLogic Server REST document patch operation
- CVE-2026-9193 Privilege escalation in Progress MarkLogic Server Hadoop integration
- CVE-2026-9192 Authentication bypass in Progress MarkLogic Server ODBC App Server
- CVE-2026-9195 Cross-site scripting in Progress MarkLogic Server Query Console
Sources
Also known as GHSA-xp9q-9vhj-ggp6.