CVE-2026-85947 in MarkLogic Server
Summary
by MITRE • 10/12/2026
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw in certain forest-management operations. A remote attacker with forest-management privileges could exploit this flaw to create a persistent unauthorized administrator account, potentially resulting in complete unauthorized administrative control of the server.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in Progress MarkLogic Server versions 12.x prior to 12.1.0 and 11.x prior to 11.3.7 represents a critical authorization bypass within the forest management subsystem. Forests are fundamental storage units in MarkLogic, responsible for housing document content and indexes. The flaw specifically affects operations related to managing these forests, which typically require elevated privileges such as admin or xd-admin roles. However, due to an insufficient access control check, users granted only forest-management permissions can execute specific administrative functions that should be restricted to higher-level administrators. This discrepancy in privilege enforcement allows a lower-privileged user to perform actions intended exclusively for system-wide administration, fundamentally undermining the principle of least privilege and the integrity of the role-based access control model implemented by the software.
The core technical flaw lies in the server's inability to properly validate whether the requesting entity possesses sufficient global administrative rights when performing certain forest-related operations that have side effects on user accounts or security configurations. By exploiting this logic error, a remote attacker who has been granted forest-management privileges can manipulate internal data structures to create new administrator accounts without proper authorization checks. These newly created accounts are persistent and possess full administrative control over the MarkLogic server environment. This capability effectively allows an attacker to escalate their privileges from limited forest management to complete system administration, bypassing all intended security boundaries designed to protect sensitive data and configuration settings.
The operational impact of this vulnerability is severe, as it leads to a total compromise of the affected MarkLogic Server instance. Once an unauthorized administrator account is established, the attacker gains unrestricted access to all databases hosted on the server. This includes the ability to read, modify, or delete any document stored within the system, alter security policies, and potentially execute administrative commands that could disrupt service availability. In enterprise environments where MarkLogic serves as a primary data repository for critical business applications, such unauthorized control can result in significant data breaches, regulatory non-compliance due to exposure of sensitive information, and potential ransomware deployment or other malicious activities facilitated by the elevated access level.
From a classification perspective, this vulnerability aligns with CWE-269 Improper Privilege Management, as it involves an actor obtaining privileges they are not authorized to have through flawed authorization logic. Furthermore, the ability to create persistent accounts for unauthorized administrative control maps directly to ATT&CK technique T1136 Create Account, which describes how adversaries create their own accounts on compromised systems or cloud environments to maintain access and facilitate further lateral movement. The exploitation of this flaw also relates to CWE-284 Improper Access Control, highlighting the failure in verifying user permissions before allowing execution of sensitive administrative functions.
To mitigate this risk, organizations running affected versions must immediately upgrade MarkLogic Server to version 12.1.0 or later for the 12.x branch, or version 11.3.7 and later for the 11.x branch. These updates contain patches that correct the authorization checks within forest management operations, ensuring that only users with appropriate global administrative privileges can perform actions that affect system-wide security configurations. In addition to applying vendor-supplied patches, administrators should review existing user roles and permissions to ensure that forest-management rights are granted strictly on a need-to-know basis. Implementing strict network segmentation to limit access to MarkLogic administration interfaces and enabling comprehensive audit logging for all administrative actions can further enhance visibility into potential exploitation attempts and support rapid incident response if the vulnerability is exploited in the wild.