Canada warns of Progress MarkLogic and MOVEit flaws

Canada’s Cyber Centre issued two October 2026 advisories urging updates for Progress MarkLogic Server and MOVEit Transfer, without naming CVEs.

The Canadian Centre for Cyber Security issued two separate Progress product advisories in mid-October 2026. Advisory AV26-1031, published October 13, says MarkLogic Server versions before 11.3.7 and before 12.1.0 are affected as of October 12 and directs administrators to Progress Customer Community and Trust Center notices and available updates. Advisory AV26-1058, issued October 16, covers MOVEit Transfer versions before 2025.1.6 and before 2026.0.4, citing Progress information current as of October 14 and Progress’s September 2026 MOVEit Transfer Critical Security Bulletin. Neither notice lists CVE identifiers or says the flaws are being exploited. The reports address different products and do not contradict each other.

• The Canadian Centre for Cyber Security published advisory AV26-1031 on October 13, 2026, covering Progress MarkLogic Server.
• As of October 12, 2026, MarkLogic Server versions before 11.3.7 and before 12.1.0 are affected; administrators are pointed to Progress Customer Community and Trust Center notices and told to apply updates.
• Advisory AV26-1058, issued October 16, 2026, covers Progress MOVEit Transfer versions before 2025.1.6 and before 2026.0.4, based on Progress information current as of October 14.
• The MOVEit notice cites Progress’s September 2026 MOVEit Transfer Critical Security Bulletin and tells administrators to review the links and apply updates.
• Neither Canadian bulletin lists CVE identifiers or states that the flaws are being exploited.