CVE-2026-7557 SAML authentication bypass in Progress MarkLogic Server

What is CVE-2026-7557?

CVE-2026-7557 is a critical authentication bypass vulnerability in Progress Software Corporation MarkLogic Server, published on 5 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An improper verification of cryptographic signature vulnerability in the SAML authentication module of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker to bypass authentication and impersonate any user, including administrators. This vulnerability affects deployments with SAML single sign-on enabled.

Weakness: CWE-347

Which versions are affected by CVE-2026-7557?

It affects 1 product.

Products include Progress Marklogic Server.

How do I fix CVE-2026-7557?

No fix has been published for CVE-2026-7557 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-7557 being exploited?

There is no known exploitation of CVE-2026-7557 in the wild and no public exploit code.

Other vulnerabilities in Progress Software Corporation MarkLogic Server

• CVE-2026-7329 Privilege escalation in Progress MarkLogic Server REST query interfaces Critical 9.9
• CVE-2026-8709 Privilege escalation in Progress MarkLogic Server REST document patch operation Critical 9.9
• CVE-2026-9193 Privilege escalation in Progress MarkLogic Server Hadoop integration Critical 9.9
• CVE-2026-9192 Authentication bypass in Progress MarkLogic Server ODBC App Server Critical 9.8
• CVE-2026-9195 Cross-site scripting in Progress MarkLogic Server Query Console Critical 9.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-j86w-xf2g-5g65.