Is CVE-2026-8709 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-8709?

CVE-2026-8709 has a CVSS v3 severity of CRITICAL (9.9).

Back

CVE-2026-8709

Description

An improper privilege management vulnerability in the REST API document patch operation of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges and execute privileged operations against the Security database.